Description

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T15:17:21.600Z",
  "pubdate": "2026-08-06T15:17:21.600Z",
  "executiveSummary": "This vulnerability involves an unauthenticated sensitive data exposure present in the Custom CSS and JavaScript plugin affecting versions 2.0.16 and below.\nThe security flaw allows remote, unauthenticated attackers to access confidential information stored within the application without requiring any prior authentication or privileged access.\nThe primary impact of this exposure includes the unauthorized retrieval of sensitive configuration data, custom code assets, or potentially proprietary operational details managed by the affected software.\nFrom a risk perspective, this enables threat actors to harvest intelligence that could facilitate subsequent attack vectors or compromise the overall integrity of the host application.\nThe exploitation requirements are minimal, as the attack surface is exposed directly to the network without authentication barriers, allowing arbitrary unauthenticated clients to trigger the data retrieval vector.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control enforcement within the Custom CSS and JavaScript plugin components responsible for handling custom code assets and configuration settings.\nSpecifically, the affected versions fail to validate whether an incoming HTTP request originates from an authenticated or authorized user before returning sensitive data payloads.\nThe vulnerable component is accessible over the network via standard HTTP/HTTPS protocols, exposing endpoints that lack adequate session validation or capability checks.\nThe affected versions include Custom CSS and JavaScript <= 2.0.16.\nThe authentication requirement is entirely absent, meaning attackers do not need valid credentials, session cookies, or elevated privileges to interact with the vulnerable endpoints.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the exposed network endpoints associated with the Custom CSS and JavaScript plugin. Second, the attacker crafts an arbitrary HTTP request directed toward these unprotected functional paths. Third, the application processes the request without validating authorization context or identity. Finally, the server responds by disclosing sensitive data or custom script/stylesheet contents directly to the remote client.\nThe post-exploitation impact includes the aggregation of exposed internal configurations, potentially assisting malicious actors in mapping application logic, identifying secondary vulnerabilities, or extracting proprietary intellectual property embedded within custom code segments."
}