CubeWP public post rendering can read traversed server files
CubeWP Framework through 1.1.30 registers cubewp_posts_output for unauthenticated AJAX requests and embeds its cubewp_posts_output nonce in pages that render the posts shortcode or widget with AJAX loading enabled. A visitor can harvest that nonce and submit attacker-controlled prev_icon or next_icon URL data. cubewp_get_svg_content() converts a same-site URL into a filesystem path and passes it to file_get_contents() without canonicalizing or containing the path, permitting traversal to files readable by PHP. Version 1.1.31 restricts reads to .svg files whose real paths remain inside the uploads directory or CubeWP's own plugin directory.
- Component
- CubeWP Framework
- Plugin slug
cubewp-framework- Affected
- <= 1.1.30
- Safe version
1.1.31- Published
- Aug 02, 2026
This CVE was published Aug 02, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update CubeWP Framework to 1.1.31 or later. Review public cubewp_posts_output requests for traversing prev_icon or next_icon values, rotate secrets from any exposed configuration files, and investigate access to sensitive server paths.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N