Executive brief
The Nimble Page Builder WordPress plugin fails to properly verify user permissions when returning unpublished content through an AJAX handler. Any logged-in user, including those with minimal permissions (Subscriber level), can request and view the draft, private, and scheduled content of other posts and pages, exposing sensitive information that should only be visible to content authors and administrators.
Technical details
The sek_get_nimble_content_for_seo_plugins AJAX action does not implement authorization checks before returning page-builder content for arbitrary posts. An authenticated attacker with Subscriber+ privileges can craft AJAX requests to retrieve non-public post content (draft, pending, private, scheduled) by bypassing post status verification, resulting in information disclosure of unpublished materials.
Affected products
- Nimble Page Builder through 3.3.8
Timeline
- 2026-09-16: disclosed
- 2026-09-19: advisory