CVE-2026-16557— Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
Quick assessment
Affected
Unknown Nimble Page Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nimble Page Builder WordPress 插件在 3.3.8 及更早版本中，在通过已认证的 AJAX 操作返回页面构建器内容时，未执行授权检查，使得任何已认证用户（订阅者及以上权限）能够泄露任意非公开（草稿、待审、私有、已计划）文章和页面的页面构建器内容。
Possible ATT&CK Techniques 1 AI
T1595 · Active Scanning
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16557
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
Source: CVE Program / CVE List V5
Vulnerability Description
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Nimble Page Builder | 0 ~ 3.3.8 | - |
|
II. Public POCs for CVE-2026-16557
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16557
请登录查看更多情报信息。
Proof of Concept for CVE-2026-16557 (1)
-
🔗 Nimble Builder <= 3.3.8 – Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins | CVE 2026-16557 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-19 · 21 CVEs total
| CVE-2026-91847 | Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection | |
| CVE-2025-15698 | Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting | |
| CVE-2026-19860 | JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validati | |
| CVE-2026-84750 | Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-76554 | WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import | |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | |
| CVE-2026-85574 | Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unb | |
| CVE-2026-85680 | Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title | |
| CVE-2026-86591 | Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder R | |
| CVE-2026-86814 | UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider | |
| CVE-2026-92435 | Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API | |
| CVE-2026-92099 | WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squ | |
| CVE-2026-88824 | Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings | |
| CVE-2026-88926 | VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi | |
| CVE-2026-92404 | MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure | |
| CVE-2026-92425 | Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR | |
| CVE-2026-92420 | Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR | |
| CVE-2026-92421 | Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR | |
| CVE-2026-92403 | Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Sub | |
| CVE-2026-92430 | Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webh |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-92435
Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken A -
CVE-2026-92430
Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order St -
CVE-2026-92403
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modifica -
CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Tak -
CVE-2026-92420
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Delet
V. Comments for CVE-2026-16557
No comments yet