Skip to content
Sign in
7.5 High

CVE-2026-13154 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is…

Description

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.

Affected products and versions

Product Affected versions Fixed in
Gutenberg Essential Blocks 6.4 earliest → < 6.4.0 6.4.0

Other CVEs of Gutenberg Essential Blocks

The 2 CVEs of Gutenberg Essential Blocks →
CVE-2026-13153 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST… 7.5 High
Track this CVE