CVE-2026-0717

MEDIUM

LottieFiles - Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure via REST API Endpoint

Title source: llm

Description

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled.

References (3)

Core 3

Core References

https://plugins.trac.wordpress.org/changeset/3442469/

Product

https://plugins.trac.wordpress.org/browser/lottiefiles/tags/3.0.0/src/common.php?marks=21,122#L21

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/19b159ca-4b41-48b4-880d-9b9dc44b3463?source=cve

Scores

CVSS v3 5.3

EPSS 0.0030

EPSS Percentile 21.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (2)

lottiefile/LottieFiles < 3.0.0

lottiefile/LottieFiles – Lottie block for Gutenberg < 3.0.0

Published Jan 14, 2026

Tracked Since Feb 18, 2026