Skip to content
Sign in
7.5 High

CVE-2026-13153 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST…

Description

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.

Affected products and versions

Product Affected versions Fixed in
Gutenberg Essential Blocks 6.4 earliest → < 6.4.0 6.4.0

Other CVEs of Gutenberg Essential Blocks

The 2 CVEs of Gutenberg Essential Blocks →
CVE-2026-13154 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is… 7.5 High
Track this CVE