Essential Blocks <= 6.4.3 - Authenticated (Contributor+) Sensitive Information Exposure via Post Grid Block 'featuredPostId' Attribute
- ID
- WPSEC-2026-0189
- Plugin
- Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (essential-blocks)
- Affected
- from 6.0.8 before 6.4.4
- Remediation
- Update to 6.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Essential Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The Gutenberg Essential Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure via the Post Grid block's featured post feature in versions 6.0.8 up to, and including, 6.4.3. This is due to the 'featuredPostId' block attribute being passed directly to get_post() and the resulting post being rendered without any check of its status, post type or password protection. This makes it possible for authenticated attackers, with Contributor-level access and above, to point the attribute at an arbitrary post ID and read the title, text, featured image and metadata of draft and private posts, revisions, and entries of non-public post types.
References
- https://wpsec.com/vuln/WPSEC-2026-0189/
- https://plugins.svn.wordpress.org/essential-blocks/tags/6.4.4/
- https://wordpress.org/plugins/essential-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS