What’s Vulnerable › Vulnerabilities
CVE-2026-13154: Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-08-26
- Weakness: CWE-200
Description
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.
Affected products
- Gutenberg Essential Blocks: before 6.4.0 — fixed in 6.4.0
How to fix
Upgrade to a fixed version: Gutenberg Essential Blocks 6.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-13154 or the next vulnerability affects your stack