WordPress Plugin Vulnerabilities

Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

Description

The plugin does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.

Proof of Concept

Affects Plugins

Plugin icon
essential-blocks
Fixed in 6.4.0

References

CVE
CVE-2026-13154

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
ab60ebee-c8b5-4bba-8138-2083ca14546a

Timeline

Publicly Published
2026-08-03 (about 3 days ago)
Added
2026-08-03 (about 2 days ago)
Last Updated
2026-08-03 (about 2 days ago)

Other

Published
Title
Published
2025-10-16
Title
Easy Post Submission < 2.0.0 - Unauthenticated Sensitive Information Exposure
Published
2024-11-05
Title
Contact Form 7 – Dynamic Text Extension < 4.5.1 - Information Disclosure via Shortcode
Published
2023-11-21
Title
UserPro < 5.1.2 - Sensitive Information Disclosure via Shortcode
Published
2025-06-13
Title
Sharable Password Protected Posts < 1.1.1 - Unauthenticated Password Protect Post Access
Published
2024-06-06
Title
Widget Options - Extended <= 5.1.0 & Widget Options <= 4.0.1 - Authenticated (Subscriber+) Information Disclosure