blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-16557

MEDIUM 4.3 CVSS 3.1
Published
September 19, 2026
Last modified
September 21, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-200
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.

Affected products and versions

  • Unknown Nimble Page Builder — Up to and including 3.3.8

References

  • wpscan.com https://wpscan.com/vulnerability/a47221d4-bd82-4813-a2de-423fbe014ea0/
  • nvd.nist.gov Official NVD record