{
 "id": "WPSEC-2026-2599",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2599/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2599/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2599/index.md",
 "title": "Fusion Page Builder <= 1.6.7 - Authenticated (Contributor+) Sensitive Information Exposure via Template Loader",
 "description": "The Fusion Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure via the template load AJAX handler in all versions up to, and including, 1.6.7 due to the handler rendering the content of any published post ID without verifying that it belongs to the template post type. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the rendered content of arbitrary published posts, including password-protected posts and posts of non-public post types.",
 "plugin": {
  "slug": "fusion",
  "name": "Fusion Page Builder",
  "full_name": "Fusion Page Builder",
  "wordpress_org": "https://wordpress.org/plugins/fusion/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fusion/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fusion"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.1",
 "remediation": "Update to 1.7.1 or later.",
 "fix_released": "2026-11-04T15:56:46+00:00",
 "published": "2026-11-05T16:45:11+00:00",
 "updated": "2026-11-05T09:51:58.956287+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2599/",
  "https://plugins.svn.wordpress.org/fusion/tags/1.7.1/",
  "https://wordpress.org/plugins/fusion/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fusion",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}