CVE-2026-13154
Received Received - Intake

Gutenberg Essential Blocks Post Type Exposure

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-13154
EUVD
EUVD-2026-53736

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
essential_blocks essential_blocks to 6.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Gutenberg Essential Blocks WordPress plugin before version 6.4.0. It allows unauthenticated users to read published entries of custom post types that were registered as non-public due to improper verification in a public REST route.

Detection Guidance

Check the installed version of the Gutenberg Essential Blocks plugin. If it is below 6.4.0, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep essential-blocks in WP-CLI.

Impact Analysis

Unauthenticated attackers could access sensitive or private content stored in non-public custom post types on your WordPress site, potentially exposing confidential data to unauthorized parties.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements for data protection such as GDPR or HIPAA, which mandate strict controls over sensitive information access and disclosure.

Mitigation Strategies

Update the Gutenberg Essential Blocks plugin to version 6.4.0 or later immediately. Disable the plugin temporarily if an update is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13154. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart