CVE-2026-16960
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Loops & Logic WordPress plugin before version 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see. This allows unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Risk Assessment
The risk includes exposure of sensitive user data (emails, roles) and site configuration, which can facilitate further attacks and breach privacy.
Recommendation
Update the Loops & Logic plugin to version 4.3.0 or later, which includes the fix restricting data access.
Other vulnerabilities in Loops & Logic
See all- CVE-2026-95604High
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
- CVE-2026-57391Medium
The Loops & Logic WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. All versions up to and including 4.2.3 are affected.
Original NVD description (English source)
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.