CVE-2026-4792 in Bread Plugin
Summary
by MITRE • 09/19/2026
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The Bread plugin for WordPress contains a critical information exposure vulnerability affecting versions up to and including 2.9.12, stemming from insufficient access control mechanisms within its core functionality. The specific flaw resides in the download_settings function, which is registered on the plugins_loaded hook but fails to enforce proper authentication or authorization checks before executing. This architectural oversight allows the function to be invoked by any user, regardless of their role or permission level, effectively exposing sensitive administrative configuration data to unauthenticated actors on public-facing pages. The vulnerability is directly exploitable via a simple HTTP request to the /?export-meeting-list=1 endpoint, which triggers the export process without verifying if the requester has valid administrator credentials.
The technical impact of this flaw is severe due to the nature of the data being exposed. The function exports all plugin configuration settings in plaintext format, including highly sensitive fields such as protection_password. Because these passwords are stored and transmitted without encryption or hashing, an attacker can immediately retrieve the PDF protection password used by the application. This exposure compromises the confidentiality integrity of the system's security controls, allowing attackers to bypass access restrictions on protected documents that rely solely on this plaintext credential for security. The lack of input validation combined with the absence of role-based checks creates a straightforward attack vector that requires no prior authentication or complex exploitation techniques.
From an industry standards perspective, this vulnerability aligns closely with CWE-200: Information Exposure and CWE-862: Missing Authorization. It also maps to ATT&CK technique T1530: Data from Cloud Storage Objects if the exported settings are considered part of the application's state data, or more accurately T1078: Valid Accounts if it leads to credential theft for further lateral movement. The exposure of plaintext credentials represents a fundamental failure in secure design principles, specifically regarding the protection of sensitive configuration parameters and the enforcement of least privilege access controls within WordPress plugin architecture.
The operational impact extends beyond simple data leakage. With access to the PDF protection password, attackers can decrypt protected documents that may contain proprietary information, personal identifiable information, or other confidential business data. This compromises not only the immediate security posture but also potentially violates regulatory compliance requirements such as GDPR or HIPAA if sensitive user data is contained within those protected files. Furthermore, knowledge of administrative passwords often serves as a stepping stone for more advanced attacks, including privilege escalation, where attackers might attempt to use these credentials against other services or systems that share password policies, thereby expanding the blast radius of the initial compromise.
Mitigation strategies must prioritize immediate remediation through software updates and defensive configuration changes. The primary solution is to upgrade the Bread plugin to a version later than 2.9.12 where this vulnerability has been patched by implementing proper capability checks within the download_settings function. Administrators should verify that only users with the manage_options capability can access settings export features. In environments where immediate patching is not feasible, temporary mitigations include restricting access to WordPress endpoints via web application firewall rules or server-level configuration to block requests containing the export-meeting-list parameter from unauthenticated sources. Additionally, organizations should audit their password policies and rotate any passwords that may have been exposed through this vulnerability to ensure continued security integrity across all dependent systems.