Executive brief
The CubeWP Framework is a WordPress plugin that enables content management and AJAX-based post loading. A directory traversal vulnerability allows unauthenticated attackers to read arbitrary files from the server, including sensitive configuration or database files. The vulnerability is easily exploitable because the required security token (nonce) is publicly visible in web page markup.
Technical details
The vulnerability is a directory traversal flaw in the 'cubewp_get_svg_content' function that fails to properly validate or sanitize file paths, allowing attackers to use path traversal sequences (e.g., ../) to access files outside the intended directory. The vulnerable function is exposed via AJAX and lacks proper path validation. Although the function requires a nonce for CSRF protection, the nonce is emitted publicly in the HTML markup of pages using CubeWP post shortcodes or widgets with AJAX loading enabled, making it harvestable by unauthenticated visitors. Attackers can read arbitrary server files by crafting AJAX requests with traversal payloads, potentially exposing wp-config.php, database credentials, or other sensitive data. A patch has been released in version 1.1.31.
Affected products
- CubeWP CubeWP Framework up to and including 1.1.30
Timeline
- 2026-08-02: disclosed