CVE-2026-5336CWE-1336CWE-200information-disclosure

CVE-2026-5336

Medium · published August 7, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.3th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-07T02:18Z
References (1)
https://wpscan.com/vulnerability/3b3ab347-a8bd-4baa-8eba-c45a8a79e33f/ · [email protected]
EPSS history
Timeline
  • 06 AUG 16:36Z
    Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
    cvelistv5