Is CVE-2026-9183 actively exploited?

No active exploitation of CVE-2026-9183 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9183 be exploited remotely?

Yes. CVE-2026-9183 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9183?

CVE-2026-9183 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-9183

MEDIUM

CVE-2026-9183

CWE-200Published: June 24, 2026· Updated: Jun 29, 2026

4.3

CVSS v3.1

EPSS:0.21%probability of exploitation in 30 daysPercentile:11.2th

Official Description

The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24_block_enqueue_scripts() function being hooked to enqueue_block_editor_assets and, for any non-administrator user, falling back to loading the administrator-configured site-wide 24liveblog integration secrets (lb24_token, lb24_refresh_token, lb24_uid, lb24_uname) from the options table via get_option() and emitting them through wp_localize_script() as the lb24BlockData JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract third-party 24liveblog account credentials (including the API token and refresh token) by simply opening the block editor and inspecting the page source.

NVD Source

Technical Analysis

CVE-2026-9183 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.