Executive brief
The Bread plugin for WordPress contains a flaw that allows unauthenticated attackers to download sensitive plugin configuration data, including plaintext PDF protection passwords. An attacker can exploit this by simply accessing a public endpoint without logging in, potentially gaining access to protected documents and bypassing security controls that depend on the password.
Technical details
The plugin's download_settings function lacks authentication and authorization checks on the plugins_loaded hook, allowing execution on public pages. Attackers can access the /?export-meeting-list=1 endpoint to retrieve all plugin configuration settings in plaintext, including the protection_password field. The vulnerability affects versions up to 2.9.12.
Affected products
- Bread Bread up to and including 2.9.12
Timeline
- 2026-09-19: disclosed