Description

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-19T08:16:54.047Z",
  "pubdate": "2026-09-19T08:16:54.047Z",
  "executiveSummary": "The Bread plugin for WordPress, in versions 2.9.12 and below, contains a critical information exposure vulnerability due to improper access control.\nThe vulnerability resides in the settings export functionality, which fails to enforce authentication or authorization checks, allowing unauthenticated attackers to retrieve sensitive plugin configurations.\nThe primary risk involves the unauthorized disclosure of the protection_password field, which is stored in plaintext within the configuration settings.\nThis allows remote, unauthenticated actors to access sensitive information by interacting with a public-facing URL endpoint.\nThe impact is significant, as it leads to a complete bypass of security configurations related to protected content, potentially facilitating further unauthorized access or data exfiltration.\nThere are no specific privilege requirements for exploitation, as the plugin registers the vulnerable function globally, making it accessible to any user or entity with network access to the target WordPress installation.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the download_settings function within the Bread plugin. This function is registered via the plugins_loaded hook and is designed to trigger an export of the plugin's configuration settings.\nThe root cause is a complete lack of security middleware; the code fails to verify the requestor's authentication status or administrative privileges before processing the export request. Furthermore, the function is explicitly configured to execute on both admin and non-admin (public-facing) page loads.\nThe exploitation process is straightforward: an attacker performs a GET request to the site URL with the specific query parameter ?export-meeting-list=1. Upon receipt of this request, the plugin invokes the download_settings function, which serializes the entire configuration object—including the sensitive protection_password field—and sends it to the browser as a downloadable response.\nBecause the protection_password is stored in plaintext within the WordPress database, the exported data requires no further cryptographic processing to interpret. This allows an attacker to programmatically extract the password from the HTTP response body.\nAffected versions include all releases up to and including 2.9.12. The exposure exists because the internal plugin architecture does not delineate between internal administrative actions and public accessibility.\nThe attack flow proceeds as follows: (1) An attacker identifies the target endpoint, which is exposed globally due to the plugin's hook registration strategy. (2) The attacker sends an unauthenticated HTTP GET request to the site's base URL appended with the trigger parameter. (3) The server-side application processes the hook, executes the download_settings function, and returns the full configuration array as a response. (4) The attacker captures the response, parses the plaintext credentials, and gains access to the protected PDF content or other restricted settings governed by the exposed password."
}