Description

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T07:16:32.303Z",
  "pubdate": "2026-09-19T07:16:32.303Z",
  "executiveSummary": "The Nimble Page Builder WordPress plugin, in versions up to and including 3.3.8, is susceptible to an Information Disclosure vulnerability due to improper access control.\nThe vulnerability stems from a lack of authorization checks within an authenticated AJAX action intended to retrieve page-builder content.\nThis security flaw allows any authenticated user, including those with minimal privileges such as 'Subscriber', to access and view the raw page-builder data of arbitrary posts, including those with restricted visibility settings (e.g., drafts, private, pending, or scheduled posts).\nThe impact is significant as it facilitates the unauthorized exposure of sensitive, non-public content and proprietary design information that is intended only for privileged roles like Editors or Administrators.\nExploitation requires the attacker to possess an active account on the WordPress installation. No special privileges beyond basic authentication are necessary to trigger the vulnerable AJAX endpoint and harvest protected post data.\nThis vulnerability highlights a critical breakdown in the principle of least privilege, allowing users to bypass intended access restrictions and view content they are not authorized to see.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Nimble Page Builder plugin to implement necessary security checks within its AJAX handler responsible for fetching page-builder metadata.\nWordPress plugins frequently register custom AJAX actions via 'wp_ajax_' hooks. These hooks must include internal checks to ensure that the user requesting the data has the appropriate capabilities (e.g., 'edit_posts', 'edit_pages') before processing the request.\nIn the affected versions of Nimble Page Builder, the AJAX action designed to retrieve page content fails to perform a 'current_user_can()' check or verify if the requested post ID is currently accessible by the authenticated user.\nThe attack flow begins with an authenticated user (Subscriber) sending an HTTP POST request to the 'wp-admin/admin-ajax.php' endpoint. The request includes the 'action' parameter associated with the Nimble Page Builder content loader and an 'id' parameter specifying the target post or page ID.\nBecause the server-side code does not validate if the requesting user has the capability to edit the requested post, the plugin retrieves the post object and associated meta-data from the database and returns the full page-builder configuration to the requester.\nThis configuration often contains sensitive text, structural layout data, and potentially shortcodes or references that reveal information about future site architecture, draft content, or internal business strategies.\nBecause the underlying WordPress core 'get_post()' or equivalent data retrieval functions are utilized without an authorization wrapper, the plugin inadvertently bypasses the visibility settings of the CMS. If the post ID exists, the server retrieves it regardless of its status—whether it is 'draft', 'pending', 'private', or 'scheduled'.\nPost-exploitation impact involves the mass enumeration of internal site data. An attacker can iterate through post IDs to systematically extract content from private pages, potentially leading to the leakage of intellectual property or sensitive business intelligence stored within page drafts.\nThis vulnerability is strictly server-side and requires the attacker to be logged into the WordPress environment, though it does not require administrative access, making it a high-risk information disclosure flaw in multi-user WordPress environments."
}