CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
Contributors can exploit Server-Side Template Injection to disclose sensitive information, including session cookies of higher-privileged users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-5336?
CVE-2026-5336 is a medium-severity code injection vulnerability in Unknown DataPress (Dataverse Integration), published on 6 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.
Which versions are affected by CVE-2026-5336?
How do I fix CVE-2026-5336?
No fix has been published for CVE-2026-5336 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-5336 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5336 exists.
Sources
Also known as GHSA-rrm7-wv5p-525q.