CVE-2026-95604
HighCVSS 7.5Summary
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
Risk Assessment
An unauthenticated attacker can access functions or data they are not authorized to, potentially leading to a security breach.
Recommendation
Update the Loops & Logic plugin to a version later than 4.2.4 that fixes this vulnerability.
Other vulnerabilities in Loops & Logic
See all- CVE-2026-16960High
The Loops & Logic WordPress plugin before version 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see. This allows unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
- CVE-2026-57391Medium
The Loops & Logic WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. All versions up to and including 4.2.3 are affected.
Original NVD description (English source)
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.