CVE-2026-16960 Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure
Unauthenticated attackers can read arbitrary user records and site options via the public template-data action in the Loops & Logic WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16960?
CVE-2026-16960 is a high-severity vulnerability in Unknown Loops & Logic, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Weakness: CWE-200
Which versions are affected by CVE-2026-16960?
How do I fix CVE-2026-16960?
No fix has been published for CVE-2026-16960 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16960 being exploited?
There is no known exploitation of CVE-2026-16960 in the wild and no public exploit code.
Sources
Also known as GHSA-h47p-xxvg-g8pg.