CVE-2026-5336

Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure

State: Published
Severity: 6.8 Medium
Published: Aug 6, 2026
Updated: Aug 7, 2026
Reserved: Apr 1, 2026

Description

The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H	WPScan

Weaknesses

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
DataPress (Dataverse Integration)Unknown	before 2.91Affected

References

https://wpscan.com/vulnerability/3b3ab347-a8bd-4baa-8eba-c45a8a79e33f/exploitvdb-entrytechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.