medium4.3
CVE-2026-16557
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJA…
Impact
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.
Affected products
| Product | Affected versions |
|---|---|
| Nimble Page Builder WordPress Plugin | through 3.3.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.