Description

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-06T22:18:10.057Z",
  "pubdate": "2026-08-06T22:18:10.057Z",
  "executiveSummary": "An information disclosure vulnerability exists in the DataPress (Dataverse Integration) WordPress plugin, specifically within its template rendering feature. The flaw arises from inadequate access controls and the improper exposure of the viewing user's contextual data during the rendering process. This security deficiency permits authenticated low-privileged users, specifically those assigned the Contributor role, to interact with the vulnerable component and exfiltrate sensitive data. The primary impact of this vulnerability is the unauthorized disclosure of confidential information, most notably the session cookies of higher-privileged users, such as Administrators, who subsequently view the affected content. Attackers possessing Contributor-level privileges can leverage this capability to harvest session credentials, potentially leading to unauthorized privilege escalation and complete administrative compromise of the affected WordPress site. Exploitation requires authenticated access at the Contributor role level and relies on social engineering or standard administrative workflows where a higher-privileged user views content crafted by the attacker. Remediation requires updating the affected product to version 2.91 or later, where access restrictions and data exposure handling are properly enforced.",
  "technicalDetails": "The vulnerability resides within the template rendering feature of the DataPress (Dataverse Integration) WordPress plugin affecting all versions prior to 2.91. The root cause of the security defect is the failure to properly enforce authorization checks on the template rendering functionality combined with the insecure exposure of the current viewing user's execution context and associated session data to the rendered template. In WordPress architecture, the Contributor role is restricted from publishing content directly and typically lacks capabilities to execute arbitrary server-side logic or access sensitive global state variables. However, the DataPress plugin improperly permits users with the Contributor role to utilize its template rendering capabilities within drafts or submitted posts.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker with a Contributor-level account creates or edits a WordPress post containing malicious or specially crafted template syntax handled by the vulnerable DataPress component. Because the access control enforcement is missing or insufficient, the plugin processes the template execution request initiated by the Contributor. Second, the attacker publishes or submits the post for review. Third, a higher-privileged user, such as an Administrator or Editor, views the affected post or preview page. During this rendering phase, the vulnerable template engine processes the request within the execution context of the viewing user, inadvertently exposing sensitive global data structures and user-specific session variables to the template output. Fourth, the malicious template logic extracts the viewing user's sensitive data—specifically session cookies or authentication tokens—and transmits this information to an attacker-controlled external server via out-of-band communication channels, such as HTTP requests, DNS lookups, or embedded image tags.\nThe post-exploitation impact is severe. By capturing the session cookies of a higher-privileged user, the attacker can perform session hijacking attacks, bypass authentication mechanisms, and assume the identity and privilege level of the victim. If an Administrator's session is successfully compromised, the attacker achieves full administrative control over the WordPress installation, enabling arbitrary code execution, plugin installation, and complete database manipulation. The vulnerability is exploitable over standard network protocols (HTTP/HTTPS) as part of normal web application interaction, contingent upon the attacker holding a Contributor role and successfully inducing a privileged user to render the vulnerable content."
}