What’s Vulnerable › Vulnerabilities

CVE-2021-24677: Find My Blocks < 3.4.0 - Private Post Titles Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-18 · updated 2026-06-17
• Weakness: CWE-862

Description

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.

Affected products

• Find My Blocks: before 3.4.0 — fixed in 3.4.0

How to fix

Upgrade to a fixed version: Find My Blocks 3.4.0. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/40c7e424-9a97-41ab-a312-2a06b607609a
• https://wpscan.com/vulnerability/40c7e424-9a97-41ab-a312-2a06b607609a

Get alerted when CVE-2021-24677 or the next vulnerability affects your stack