medium6.8
CVE-2026-5336
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing …
Impact
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.
Affected products
| Product | Affected versions |
|---|---|
| DataPress (Dataverse Integration) WordPress Plugin | before 2.91 |
Versions were read from the advisory text. No structured product data has been published for this record yet.