CVE-2026-13153: Essential Blocks Information Disclosure Flaw

CVE-2026-13153 Overview

CVE-2026-13153 affects the Gutenberg Essential Blocks WordPress plugin in versions prior to 6.4.0. The plugin exposes a public REST route without proper access restrictions and over-fetches non-public WooCommerce data into responses. Unauthenticated attackers can read the lifetime number of units sold for any published product on affected stores. The flaw is a broken access control issue combined with sensitive business data exposure. Store operators using the vulnerable plugin risk leaking commercially sensitive sales metrics to competitors, scrapers, and market researchers.

Critical Impact
Unauthenticated remote attackers can enumerate lifetime per-product sales counts across any WooCommerce store running Gutenberg Essential Blocks before version 6.4.0.

Affected Products

Gutenberg Essential Blocks WordPress plugin versions prior to 6.4.0
WooCommerce-integrated WordPress sites that install the vulnerable plugin
Any published WooCommerce product served by an affected site

Discovery Timeline

2026-08-06 - CVE-2026-13153 published to the National Vulnerability Database
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-13153

Vulnerability Analysis

The vulnerability resides in a public REST API endpoint registered by the Gutenberg Essential Blocks plugin. The route does not implement a permission_callback that restricts access to authorized roles. As a result, requests from unauthenticated clients receive full responses from the endpoint. The endpoint's response payload includes a WooCommerce per-product sales metric that was never intended to be public. This metric reports the total lifetime units sold for a given published product. The exposure represents a business logic and access control failure rather than a memory safety defect.

Root Cause

The root cause is twofold. First, the REST route lacks an authentication or capability check, so it is reachable by anyone who can send an HTTP request to the site. Second, the server-side handler over-fetches product metadata and serializes the internal total_sales field into the JSON response. The plugin should either scope the endpoint to authenticated administrators or strip non-public fields before returning data to clients.

Attack Vector

An attacker interacts with the plugin's public REST endpoint over HTTP or HTTPS. No credentials, cookies, or user interaction are required. The attacker iterates published product identifiers and parses the sales metric from each response. Automated scripts can enumerate an entire catalog in minutes and archive competitive intelligence. See the WPScan Vulnerability Report for technical details on the affected route.

Detection Methods for CVE-2026-13153

Indicators of Compromise

Repeated unauthenticated GET requests to the plugin's /wp-json/ REST namespace from a small set of source IP addresses
High-volume enumeration patterns targeting sequential product identifiers
Requests originating from data-center ASNs or known scraping infrastructure hitting the plugin endpoint
Access logs showing responses containing total_sales field values returned to unauthenticated clients

Detection Strategies

Inspect web server and WordPress access logs for anomalous request rates against Essential Blocks REST routes
Correlate unauthenticated REST responses that include WooCommerce sales fields with the client user agent and source IP
Deploy a web application firewall rule that alerts on repeated access to the affected plugin endpoint without a valid session cookie

Monitoring Recommendations

Ingest WordPress and WooCommerce access logs into a centralized log platform for baseline and outlier analysis
Alert on sudden spikes in /wp-json/ traffic that exceed historical norms for the site
Track the plugin version installed across managed WordPress fleets and flag any host still running a version below 6.4.0

How to Mitigate CVE-2026-13153

Immediate Actions Required

Upgrade the Gutenberg Essential Blocks plugin to version 6.4.0 or later on every affected WordPress site
Audit WooCommerce REST responses to confirm that total_sales and other non-public fields no longer appear for unauthenticated callers
Review access logs for prior enumeration activity and document exposed products for internal risk assessment

Patch Information

The plugin vendor addressed the issue in Gutenberg Essential Blocks 6.4.0. The fix adds access control on the affected REST route and removes the over-fetched sales metric from the response. Refer to the WPScan Vulnerability Report for the vendor advisory link and confirmed fixed version.

Workarounds

Deactivate the Gutenberg Essential Blocks plugin until the update to 6.4.0 can be applied
Block unauthenticated requests to the plugin's REST namespace at the web application firewall or reverse proxy
Restrict access to /wp-json/ endpoints by source IP where feasible during the remediation window

bash

# Example nginx rule to block unauthenticated access to the affected REST namespace
location ~ ^/wp-json/essential-blocks/ {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}