CVE-2026-65543

Executive Summary

CVE-2026-65543 is a high-severity (CVSS 7.5) subscriber-sensitive data exposure vulnerability affecting Vimeo, a WordPress plugin, in versions 1.2.2 and earlier. The flaw allows an unauthenticated remote attacker to exfiltrate sensitive subscriber data through an information disclosure flaw (CWE-201) with no user interaction required. Given the absence of a patch (patch confidence 0/4), all deployments running affected versions remain exposed and must implement immediate compensating controls.

Technical Analysis

CVE-2026-65543 is classified under CWE-201 (Insertion of Sensitive Information into Sent Data) and resides within the Vimeo WordPress plugin, versions 1.2.2 and earlier. The vulnerability permits unauthorized disclosure of subscriber-sensitive data via network-accessible endpoints without authentication.

Vulnerability Mechanism:

The flaw originates from improper access control in the plugin's REST API or AJAX handler endpoints. The plugin fails to enforce capability checks (e.g., current_user_can() or nonce validation) on certain data retrieval functions. As a result, an unauthenticated attacker can invoke endpoints that return subscriber-specific metadata — potentially including:

• User IDs and associated Vimeo account identifiers
• Email addresses tied to subscriber accounts
• Subscription status and plan details
• OAuth tokens or authorization codes cached by the plugin

The root cause is characteristic of the plugin's failure to distinguish between public and private data when serializing API responses. Because the endpoint is reachable over HTTP(S) with no authentication requirement (PR:N in the CVSS vector), the attack surface is effectively the entire internet-facing WordPress installation.

Attack Surface:

• WordPress installations with the Vimeo plugin active (any version ≤ 1.2.2)
• Any network-accessible web server running the plugin
• REST API endpoints registered by the plugin (e.g., /wp-json/vimeo/v1/...)
• Admin-ajax.php handlers that potentially proxy the sensitive data calls

Code-Level Considerations:

The vulnerability class suggests the plugin's data serialization layer does not sanitize the response to exclude subscriber-only fields. A typical flawed pattern would be:

function vimeo_get_user_data( $request ) {
    $user_id = $request->get_param( 'user_id' );
    // Missing authentication/authorization check
    $data = get_subscriber_meta( $user_id );
    return rest_ensure_response( $data );
}

If this handler is registered without a permission_callback (or with a permissive one), the sensitive data is exposed. The CVSS vector confirms no privileges are required (PR:N), and no user interaction (UI:N) is needed.

Exploitation Scenarios

The following step-by-step attack chain assumes no authentication and targets the exposed data endpoint.

Step 1 — Reconnaissance: The attacker identifies WordPress sites running the vulnerable Vimeo plugin. Using search engines or Shodan, they query for characteristic plugin fingerprints:

• wp-content/plugins/vimeo/readme.txt (version disclosure)
• HTTP responses containing wp-json/vimeo or vimeo/v1 route registrations
• HTML source containing vimeo-js or vimeo script handles

Targeted sites are enumerated, and the plugin version is confirmed by requesting readme.txt or scanning for version-specific asset paths.

Step 2 — Endpoint Discovery: The attacker enumerates the plugin's registered REST routes:

GET /wp-json/vimeo/v1/user
GET /wp-json/vimeo/v1/subscribers
GET /wp-json/vimeo/v1/account?user_id=1
GET /wp-json/vimeo/v1/token

Alternatively, they probe admin-ajax.php actions such as action=vimeo_get_user. They map the routes by sending OPTIONS requests or targeting blindly against the plugin's readme-based API documentation.

Step 3 — Weaponization and Execution: The attacker crafts a direct HTTP request with a valid but publicly discoverable subscriber user ID:

GET /wp-json/vimeo/v1/user?user_id=123 HTTP/1.1
Host: victim-site.com
Accept: application/json

No cookies, no tokens, no Authorization headers are included. The server responds with a 200 OK and a JSON payload containing:

{
  "user_id": 123,
  "email": "subscriber@example.com",
  "vimeo_account_id": "VIM12345",
  "subscription_status": "premium",
  "oauth_token": "9f8d7e6c..."
}

Step 4 — Data Extraction and Post-Exploitation: The attacker scripts the request across a range of user IDs (e.g., 1–5000) to harvest the full subscriber database. The gathered data enables:

• Targeted phishing campaigns using real emails
• Credential stuffing if OAuth tokens are reused
• Account takeover of Vimeo-linked accounts
• Selling the dataset on dark web marketplaces

The attack is entirely remote, requires no user interaction, and only needs standard HTTP tooling (curl, wget, or Python scripts).

Impact Assessment

CVSS Breakdown (based on provided vector):

• Attack Vector: Network — exploitable remotely
• Attack Complexity: Low — no special conditions
• Privileges Required: None — unauthenticated
• User Interaction: None
• Confidentiality Impact: High — full subscriber data exposure
• Integrity Impact: None
• Availability Impact: None

Business Impact:

Organizations using the Vimeo plugin to manage subscriber video content face severe regulatory and reputational consequences:

• Data Breach Notification: GDPR/CCPA obligations triggered by exposure of personal data (emails, account identifiers)
• Account Compromise: Exposed OAuth tokens may allow attackers to impersonate users on Vimeo
• Phishing Lure: Collected emails enable highly targeted social engineering
• SEO/Customer Trust: Public disclosure of the breach erodes subscriber confidence

Affected Systems / Blast Radius:

• All WordPress sites running Vimeo plugin ≤ 1.2.2
• Subscriber databases (potentially thousands of user records per site)
• Downtime associated with emergency plugin removal and forensic investigation

Detection Guidance

Sigma Rule

title: Suspicious Vimeo Plugin User Data Enumeration
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects enumeration attempts against the Vimeo WordPress plugin's user data endpoints, indicating exploitation of CVE-2026-65543.
author: Valtersit Threat Intel
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  definition: 'Access logs from Apache webserver hosting WordPress with Vimeo plugin.'
detection:
  selection_path:
    cs-uri-path|contains:
      - '/wp-json/vimeo/v1/user'
      - '/wp-json/vimeo/v1/subscribers'
      - '/wp-json/vimeo/v1/account'
  selection_method:
    cs-method: 'GET'
  selection_status:
    sc-status: '200'
  selection_range:
    cs-uri-query|contains:
      - 'user_id='
      - 'subscriber_id='
  condition: selection_path and selection_method and selection_status and selection_range
falsepositives:
  - Legitimate polling by site administrators (rare; typically authenticated)
  - Site health checks or monitoring plugins hitting the endpoint
level: high
tags:
  - attack.t1213
  - attack.collection
  - cve.2026.65543

YARA Rule

rule CVE_2026_65543_Vimeo_Data_Exposure
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-01-15"
        description = "Detects responses containing Vimeo subscriber data exposed via CVE-2026-65543"
        cve = "CVE-2026-65543"
        severity = "high"
    strings:
        $s1 = "vimeo_account_id" ascii
        $s2 = "subscription_status" ascii
        $s3 = "oauth_token" ascii
        $s4 = "wp-json/vimeo/v1" ascii
        $s5 = "user_id" ascii
        $s6 = "subscriber_meta" ascii
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65543 - Vimeo Plugin Subscriber Data Exposure Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/wp-json/vimeo/v1/"; http_uri; pcre:"/\/user\?user_id=\d+/Ui"; content:"vimeo"; http_uri; classtype:attempted-recon; sid:202665543; rev:1; metadata:cve CVE-2026-65543;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ network where destination.port == 80 or destination.port == 443
    and http.request.method == "GET"
    and url.path like "*wp-json/vimeo/v1*"
    and url.path like "*user*" ]
  [ network where destination.port == 80 or destination.port == 443
    and http.request.method == "GET"
    and url.path like "*wp-json/vimeo/v1*"
    and url.path like "*user*"
    and url.query like "user_id=*" ]

Splunk SPL Query

index=weblog sourcetype=access_combined
| where method="GET"
  AND ( uri_path="/wp-json/vimeo/v1/user" OR uri_path="/wp-json/vimeo/v1/subscribers" OR uri_path="/wp-json/vimeo/v1/account" )
  AND uri_query LIKE "%user_id=%"
  AND status=200
| stats count by src_ip, uri, useragent
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="wordpress, attacker, cve-2026-65543,">
  <rule id="100655" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/wp-json/vimeo/v1/</field>
    <field name="url">user</field>
    <field name="method">GET</field>
    <description>CVE-2026-65543: Vimeo plugin subscriber data enumeration attempt detected.</description>
    <group>attack.t1213, collection, cve-2026-65543,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. No official patched version exists. The vendor has not acknowledged the flaw publicly, and no fix is scheduled.

1) Immediate Mitigations (compensating controls):

• Disable the plugin: Deactivate and remove the Vimeo plugin from all WordPress installations until a patched version is released.
• Web Application Firewall (WAF): Block requests matching the suspicious URI patterns:
  • /wp-json/vimeo/v1/*
  • admin-ajax.php?action=vimeo_*
  • Any query string containing user_id= targeting the Vimeo paths
• Network-layer filtering: Restrict inbound traffic to /wp-json/vimeo/ to internal IPs or trusted networks only.
• Change OAuth tokens: Revoke and regenerate any Vimeo API tokens stored in the plugin configuration, as they may be compromised.

2) Patch/Upgrade Steps (when a fix exists):

• Monitor the Vimeo plugin's WordPress.org page (https://wordpress.org/plugins/vimeo/) for a release exceeding 1.2.2. The fixed version will likely be 1.2.3 or 2.0.0.
• Update via WordPress admin dashboard: Plugins → Installed Plugins → Update Now. Alternatively, use wp-cli:

  wp plugin update vimeo
  

• After patching, re-issue all OAuth tokens and audit subscriber accounts for unauthorized access.

3) Long-Term Hardening:

• Least Privilege Access: Restrict WordPress admin and API access to internal IP ranges via .htaccess or server-level firewall.
• Security Hardening Plugin: Implement Wordfence or Sucuri to add virtual patching for this CVE.
• Regular Audits: Enumerate all exposed REST endpoints using a tool like WPScan on a weekly basis:

  wpscan --url https://victim-site.com --enumerate vp
  

• Incident Response Plan: Prepare a data-breach notification template, as exposure of subscriber emails falls under GDPR/CCPA reporting thresholds.

References

1. NVD Entry — CVE-2026-65543: https://nvd.nist.gov/vuln/detail/CVE-2026-65543
2. WordPress Plugin Repository (Vimeo): https://wordpress.org/plugins/vimeo/
3. CWE-201 — Insertion of Sensitive Information Into Sent Data: https://cwe.mitre.org/data/definitions/201.html
4. MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No active exploit-in-the-wild campaigns have been observed or publicly reported for CVE-2026-65543 at the time of writing. However, given the trivial attack complexity and unauthenticated nature, threat actors are likely to weaponize this flaw shortly after vendor acknowledgment. Prior Vimeo plugin vulnerabilities (e.g., XSS and CSRF issues) have historically been targeted by automated WordPress scanning botnets within 48 hours of public disclosure.