CVE-2026-16960 — Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to re…
Published: 2026-09-09 · CVSS: 7.5 · CVSS 3.1
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7