CVE-2026-0717

{"id": "CVE-2026-0717", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-01-14T06:15:55.670", "references": [{"url": "https://plugins.trac.wordpress.org/browser/lottiefiles/tags/3.0.0/src/common.php?marks=21,122#L21", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3442469/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19b159ca-4b41-48b4-880d-9b9dc44b3463?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The LottieFiles \u2013 Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled."}, {"lang": "es", "value": "El plugin LottieFiles \u2013 Lottie block para Gutenberg para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n sensible en todas las versiones hasta la 3.0.0, inclusive, a trav\u00e9s del endpoint de la API REST `/wp-json/lottiefiles/v1/settings/`. Esto permite a atacantes no autenticados recuperar las credenciales de la cuenta de LottieFiles.com del propietario del sitio, incluyendo su token de acceso a la API y direcci\u00f3n de correo electr\u00f3nico, cuando la opci\u00f3n 'Compartir cuenta de LottieFiles con otros usuarios de WordPress' est\u00e1 habilitada."}], "lastModified": "2026-04-08T17:21:06.417", "sourceIdentifier": "security@wordfence.com"}