NerdPress Hubbub Lite: Sensitive data exposure in WordPress plugin

Summary

The WordPress plugin Hubbub Lite (slug social-pug) up to and including version 1.36.3.1 can expose sensitive information to unauthenticated remote users. According to the CVE record, an attacker can retrieve embedded sensitive data over the network without privileges or user interaction. The published CVSS score is 5.3 (Medium) with confidentiality impact only; the exact data at risk is not described in the sources.

Affected

• NerdPress Hubbub Lite (WordPress plugin, slug social-pug) from n/a through 1.36.3.1

Fixed in

• Version 1.36.3.2 or later (according to the CVE record and Patchstack). Not yet confirmed on WordPress.org.

Workaround

• Unknown. No vendor-documented workaround is available.

Exploitation

• No known exploitation at the time of publication (CISA SSVC: exploitation none).
• VulDB reports no available exploit; no public proof of concept found.

Our recommendation

• Check whether any WordPress site uses Hubbub Lite, including sites where it is only used as a sharing widget.
• Update to version 1.36.3.2 or later once the release is confirmed on WordPress.org or in the Patchstack entry.
• Review web server logs for unusual requests after patching.
• Check the plugin changelog before relying on the fixed version, because an earlier changelog entry describes a different fix.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-125767 www.cve.org
• Patchstack advisory patchstack.com
• VulDB CVE entry vuldb.com
• OffSeq threat radar radar.offseq.com
• WordPress.org plugin page social-pug wordpress.org
• Wordfence threat intelligence social-pug www.wordfence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:37.