DataPress permits Contributor-level disclosure of viewer data before 2.91
DataPress before 2.91 lets a Contributor create Twig-rendered content while exposing the viewing request's cookies through the Twig params and request.params objects. When a higher-privileged user views that content, attacker-controlled template expressions can read sensitive viewer cookies and may enable session compromise. Version 2.91 removes cookies from Twig request parameters by default. The exact editor field, shortcode or block, rendering endpoint, Twig expression and PHP rendering function are not disclosed.
- Component
- DataPress (Dataverse Integration)
- Plugin slug
datapress-dataverse-integration- Affected
- < 2.91
- Safe version
2.91- Published
- Aug 06, 2026
This CVE was published Aug 06, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update DataPress to 2.91 or later and keep ICDS_TWIG_EXPOSE_COOKIES disabled. Review Contributor-controlled templates for cookie access and invalidate privileged sessions that may have been exposed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H