HIGHCVSS 8.6

CVE-2026-29205

CVE-2026-29205 updated by NVD

Modified: 2026-08-14
Sources: nvd

Summary

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
WordPress	wp_squared	[object Object]	—

References

https://nvd.nist.gov/vuln/detail/CVE-2026-29205

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.