Executive brief
Loops & Logic is a WordPress plugin used to create dynamic content and templates on websites. A flaw in the plugin before version 4.3.0 allows visitors without an account to view sensitive information they should not have access to, including other users' email addresses, roles, and site configuration settings. This could lead to account takeover, privilege escalation, or targeted social engineering attacks against administrators.
Technical details
The vulnerability is a sensitive data disclosure flaw (CWE-200) in the plugin's public template-data action endpoint. The endpoint fails to implement proper access controls, allowing unauthenticated users to retrieve arbitrary user records (including email and role information) and arbitrary site options without authentication or authorization checks. The attack requires only network access to the WordPress site and no user interaction; an attacker can directly query the template-data action to extract sensitive data. The vulnerability was fixed in version 4.3.0.
Affected products
- Tangible Loops & Logic before 4.3.0
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 4.3.0