24liveblog Live Blog Tool Plugin up to 2.2 on WordPress Javascript Object lb24_block_enqueue_scripts information disclosure

Summaryinfo

A vulnerability described as problematic has been identified in 24liveblog Live Blog Tool Plugin up to 2.2 on WordPress. This issue affects the function lb24_block_enqueue_scripts of the component Javascript Object Handler. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2026-9183. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in 24liveblog Live Blog Tool Plugin up to 2.2 on WordPress. This vulnerability affects the function lb24_block_enqueue_scripts of the component Javascript Object Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24_block_enqueue_scripts() function being hooked to enqueue_block_editor_assets and, for any non-administrator user, falling back to loading the administrator-configured site-wide 24liveblog integration secrets (lb24_token, lb24_refresh_token, lb24_uid, lb24_uname) from the options table via get_option() and emitting them through wp_localize_script() as the lb24BlockData JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract third-party 24liveblog account credentials (including the API token and refresh token) by simply opening the block editor and inspecting the page source.

The weakness was presented by Joy Gilbert. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-9183 since 05/21/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Blog Software

Vendor

• 24liveblog

Name

• Live Blog Tool Plugin

Version

• 2.0
• 2.1
• 2.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion