CVE-2026-2589: 
WordPress vulnerability analysis and mitigation

CVE-2026-2589 is a Sensitive Information Exposure vulnerability in the Greenshift – Animation and Page Builder Blocks plugin for WordPress, classified under CWE-200. It affects all versions up to and including 12.8.3, where an automated Settings Backup is stored in a publicly accessible file, allowing unauthenticated attackers to retrieve sensitive API keys. Affected credentials include those for OpenAI, Claude, Google Maps, Gemini, DeepSeek, and Cloudflare Turnstile. The vulnerability was published on March 6, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Wordfence).

The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the Greenshift plugin automatically generates a settings backup file containing API keys and stores it at a predictable, publicly accessible path within the WordPress installation — without any access controls or authentication requirements. An unauthenticated remote attacker can directly request this file over HTTP to extract all stored API credentials. No special privileges, user interaction, or complex conditions are required for exploitation (Wordfence, Feedly).

Successful exploitation results in the exposure of sensitive third-party API keys configured within the plugin, including credentials for AI services (OpenAI, Claude, Gemini, DeepSeek), Google Maps, and Cloudflare Turnstile. Leaked API keys can be abused by attackers to incur financial costs on the victim's accounts, access or exfiltrate data from connected AI/cloud services, or bypass CAPTCHA protections (via the Cloudflare Turnstile key). There is no direct integrity or availability impact on the WordPress site itself, but the downstream consequences of API key theft can be significant (Wordfence).

The vulnerability requires no authentication, no user interaction, and no special privileges — any remote attacker who can reach the WordPress site can exploit it. The EPSS score is approximately 0.029% (0.000290), indicating low observed exploitation probability at time of scoring. No evidence of active in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported. A patch was made available via the WordPress plugin repository changeset (Feedly, WordPress Changeset).

1. Reconnaissance: Identify WordPress sites running the Greenshift – Animation and Page Builder Blocks plugin (versions ≤ 12.8.3) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/greenshift).
2. Locate the backup file: Determine the predictable path of the publicly accessible settings backup file within the plugin's directory structure (e.g., wp-content/plugins/greenshift-animation-and-page-builder-blocks/).
3. Retrieve the file: Send an unauthenticated HTTP GET request directly to the backup file URL to download its contents.
4. Extract API keys: Parse the downloaded file to extract configured API keys for OpenAI, Claude, Google Maps, Gemini, DeepSeek, and Cloudflare Turnstile.
5. Abuse extracted credentials: Use the stolen API keys to make unauthorized API calls, incur charges on victim accounts, access AI service data, or bypass CAPTCHA protections (Wordfence).

• Network: Unauthenticated HTTP GET requests to the Greenshift plugin directory targeting backup or settings export files (e.g., paths containing greenshift and file extensions like .json or .bak); unusual external IP addresses accessing plugin file paths directly.
• Logs: WordPress/web server access logs showing direct file requests to wp-content/plugins/greenshift-animation-and-page-builder-blocks/ from non-administrative IPs, particularly for backup or settings files.
• File System: Presence of a world-readable settings backup file in the Greenshift plugin directory containing plaintext API keys.

Update the Greenshift – Animation and Page Builder Blocks plugin to version 12.8.4 or later, which addresses the publicly accessible backup file issue (WordPress Changeset). As an interim workaround, administrators can add a .htaccess rule or web server configuration to block direct HTTP access to the plugin's backup files. Additionally, immediately rotate any API keys (OpenAI, Claude, Google Maps, Gemini, DeepSeek, Cloudflare Turnstile) that were configured in the plugin on affected installations, as they should be considered compromised (Wordfence).

The vulnerability was reported by Wordfence and covered in Sucuri's March 2026 vulnerability patch roundup, indicating routine community awareness within the WordPress security ecosystem (Sucuri Blog). No significant independent researcher commentary or major media coverage beyond standard vulnerability tracking has been identified.