CVE-2026-120520 Details

A vulnerability allowing sensitive information exposure has been identified in the Greenshift animation and page builder blocks plugin for WordPress, affecting all versions through 13.2.2. The issue arises from the 'img' parameter, or any key referenced by the publisher in the '{{GET:key}}' format. This vulnerability enables unauthenticated attackers to extract HttpOnly WordPress session cookies, specifically the 'wordpress_logged_in_*' tokens, from authenticated users. The exploitation involves injecting a nested '{{COOKIE:}}' placeholder through a GET parameter, which prompts the victim's browser to send the cookie value to an attacker-controlled host as an image source URL. For this attack to succeed, a site publisher must have set up a public GreenShift Element image block with a '{{GET:}}' placeholder in the source attribute. Additionally, the targeted logged-in user must be persuaded to click on the crafted link, as neither condition is part of the plugin's default configuration.

Users are advised to update the Greenshift WordPress plugin to version 13.2.3 or a newer patched version.