CVE-2026-16960

CVE-2026-16960 is an information disclosure flaw (CWE-200) in the Loops & Logic WordPress plugin, where the plugin's public template-data action does not limit its response to data the requesting visitor is allowed to see. An unauthenticated attacker can trigger the flaw by sending a request to that public action, and the plugin will return data without any access control. As a result, the attacker can read arbitrary user records from the affected site — including users' email addresses and roles — as well as arbitrary site options, which may leak sensitive or security-relevant settings. Any WordPress site running a version of the Loops & Logic plugin before 4.3.0 is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no exploitation has been reported in the wild.

What to do: Update the Loops & Logic plugin to version 4.3.0 or later, which restricts the public template-data action to permitted data. If immediate updating is not possible, block or restrict unauthenticated access to the plugin's template-data action (for example via a WAF rule). Review access logs for unauthenticated requests to this action and consider that user email addresses, roles, and site options may have been exposed.