WordPress Plugin Vulnerabilities

Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint

Description

The plugin does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.

Proof of Concept

Affects Plugins

Plugin icon
essential-blocks
Fixed in 6.4.0

References

CVE
CVE-2026-13153

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
0401a229-9630-49ab-ae4b-53360cf5d109

Timeline

Publicly Published
2026-08-03 (about 3 days ago)
Added
2026-08-03 (about 2 days ago)
Last Updated
2026-08-03 (about 2 days ago)

Other

Published
Title
Published
2026-08-03
Title
WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
Published
2026-04-28
Title
Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure
Published
2024-10-14
Title
Contact Forms, Live Support, CRM, Video Messages < 1.11.1 - Unauthenticated Information Disclosure
Published
2024-04-25
Title
WP-Members Membership Plugin < 3.4.9.4 - Unprotected Storage of Potentially Sensitive Files
Published
2026-04-06
Title
IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure