Essential Blocks <= 6.4.3 - Unauthenticated Denial of Service via Post Grid Pagination
- ID
- WPSEC-2026-0190
- Plugin
- Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (essential-blocks)
- Affected
- from 4.2.0 before 6.4.4
- Remediation
- Update to 6.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-400
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Essential Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The Gutenberg Essential Blocks plugin for WordPress is vulnerable to Denial of Service via the public Post Grid pagination AJAX action (post_grid_block_pagination) in versions 4.2.0 up to, and including, 6.4.3. This is due to the client-supplied 'totalPosts' and 'per_page' values being used to compute a page count that the handler loops over with no upper bound while building the response. The nonce the action requires is printed on public pages, which makes it possible for unauthenticated attackers to send requests that each consume a PHP worker's memory and CPU until its limits are reached, degrading site availability.
References
- https://wpsec.com/vuln/WPSEC-2026-0190/
- https://plugins.svn.wordpress.org/essential-blocks/tags/6.4.4/
- https://wordpress.org/plugins/essential-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS