Atomic Edge analysis of CVE-2026-65543 (metadata-based):
The Vimeo plugin for WordPress, versions up to and including 1.2.2, exposes sensitive user or configuration data to authenticated attackers with subscriber-level access or higher. The vulnerability carries a CVSS score of 4.3 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a low-complexity network attack requiring low-privilege authentication, with a limited confidentiality impact. The CWE-200 classification points to an information disclosure flaw where the plugin fails to restrict access to sensitive data. Atomic Edge analysis is based solely on the provided metadata; no source code diff or patch information is available, so all root cause and exploitation details are inferred from the CWE and common WordPress plugin patterns.
The root cause of this vulnerability likely lies in an AJAX handler or REST API endpoint that returns sensitive data without proper capability checks. In WordPress, subscriber-level users can access AJAX actions prefixed with wp_ajax_ if the handler does not enforce a higher permission level (e.g., manage_options). The plugin may expose user metadata, site configuration options, or internal API keys through an endpoint that lacks a nonce verification or a current_user_can() check. Atomic Edge research infers that the affected endpoint is likely an admin-ajax action or a custom REST route that serializes data directly to the response. Because the description specifies sensitive user or configuration data, the flaw likely involves direct database queries or retrieval of WordPress options without sanitization or authorization.
To exploit this vulnerability, an authenticated attacker with subscriber-level credentials would craft a POST request to /wp-admin/admin-ajax.php with an action parameter that matches the plugin’s handler. Based on the plugin slug ‘vimeo’, common handler names could be ‘vimeo_get_user_data’, ‘vimeo_get_config’, or similar. The attacker would include a user_id parameter to target a specific user, or the handler might return data for all users. Since the vulnerability likely lacks a capability check, the handler executes for any authenticated user. The response would contain the exposed data in JSON or serialized form. A subscriber account is sufficient, so the attacker needs no additional privileges.
Remediation for this vulnerability requires the plugin developers to add proper authorization checks to the affected AJAX or REST endpoints. Specifically, the handler must verify that the current user has the required capability, such as edit_posts or manage_options, before returning any sensitive data. Additionally, the plugin should implement nonce verification (check_ajax_referer or wp_verify_nonce) to prevent cross-site request forgery and ensure that requests originate from legitimate plugin interactions. Furthermore, any data returned to the client should be filtered to exclude sensitive fields unless the requesting user has explicit permission to view them. Since no patched version is available, affected sites should monitor and restrict access to the plugin’s endpoints until a fix is released.
If exploited, this vulnerability allows a subscriber-level user to extract sensitive information that should only be accessible to administrators or site owners. That could include user email addresses, API keys, database credentials, or internal plugin configuration. The exposure of such data could facilitate further attacks, such as account takeover, unauthorized access to external services, or targeted phishing. While the confidentiality impact is limited (C:L) and there is no integrity or availability impact, the leak of configuration data may give attackers a foothold to escalate privileges or compromise the underlying WordPress installation. Atomic Edge research assesses the risk as medium, with the primary threat being data disclosure and subsequent lateral movement.
