high7.5
CVE-2026-16960
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthent…
Impact
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Affected products
| Product | Affected versions |
|---|---|
| Loops & Logic WordPress Plugin | before 4.3.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.