CVE-2026-13339— CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Quick assessment
Affected
cubewp1211 CubeWP Framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress CubeWP Framework是WordPress基金会的一个网站后台内容管理框架。 WordPress CubeWP Framework 1.1.30及之前版本存在路径遍历漏洞，该漏洞源于cubewp_get_svg_content函数存在目录遍历漏洞，可能导致未经身份验证的攻击者读取服务器上任意文件内容，其中可能包含敏感信息。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| cubewp1211 | CubeWP Framework | ≤ 1.1.30 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13339
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress CubeWP Framework 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress CubeWP Framework是WordPress基金会的一个网站后台内容管理框架。 WordPress CubeWP Framework 1.1.30及之前版本存在路径遍历漏洞，该漏洞源于cubewp_get_svg_content函数存在目录遍历漏洞，可能导致未经身份验证的攻击者读取服务器上任意文件内容，其中可能包含敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| cubewp1211 | CubeWP Framework | 0 ~ 1.1.30 | - |
|
II. Public POCs for CVE-2026-13339
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13339
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-13339 (1)
IV. Related Vulnerabilities
Same product: CubeWP Framework
-
CVE-2026-17018
CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and -
CVE-2026-17017
CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cu -
CVE-2026-6453
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL -
CVE-2025-6461
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Un -
CVE-2025-8615
CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross
Same vendor: cubewp1211
-
CVE-2026-6453
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL -
CVE-2025-6461
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Un -
CVE-2025-8615
CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross -
CVE-2025-12129
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Un -
CVE-2025-4315
CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Au
Same weakness: CWE-22
-
CVE-2026-109118
Improper Limitation of a Pathname to a Restricted Directory -
CVE-2026-103896
10Web Booster <= 2.34.5 - Unauthenticated Limited File Write -
CVE-2026-93767
Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Travers -
CVE-2026-109221
Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) -
CVE-2026-104769
Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via '
V. Comments for CVE-2026-13339
No comments yet