CVE-2026-16960 — Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure

CVE-2026-16960

Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure PUBLISHED

Description (CNA)

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

Affected (CNA)

Vendor / product	Versions
Unknown / Loops & Logic	affected 0 before 4.3.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/70344f9a-065d-4611-b958-0297af6f2c63/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.