CVE-2026-13154: Gutenberg Essential Blocks Disclosure Flaw

CVE-2026-13154 Overview

CVE-2026-13154 affects the Gutenberg Essential Blocks WordPress plugin in versions before 6.4.0. The plugin fails to verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes. Unauthenticated users can read published entries of custom post types that site administrators registered as non-public. The flaw is a broken access control issue that exposes content administrators intended to keep private from anonymous visitors.

Critical Impact
Unauthenticated attackers can enumerate and read the contents of non-public custom post types through the plugin's REST endpoints, bypassing WordPress visibility controls.

Affected Products

Gutenberg Essential Blocks WordPress plugin versions prior to 6.4.0
WordPress sites using the plugin with custom post types registered as non-public
Any site relying on the public => false post type flag for access control on Essential Blocks REST routes

Discovery Timeline

2026-08-06 - CVE-2026-13154 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-13154

Vulnerability Analysis

The Gutenberg Essential Blocks plugin exposes public REST API routes that accept a post type parameter from the client. The plugin queries the requested post type and returns published entries without first checking the post type's public property. WordPress allows developers to register custom post types with public => false to hide them from anonymous frontend access and from the default REST API surface. The plugin's REST handler bypasses this control by trusting the supplied post type name and executing the query regardless of visibility settings.

The vulnerability is classified as a broken access control flaw. It does not require authentication, session tokens, or user interaction. An attacker only needs the ability to send HTTP requests to the WordPress REST endpoint provided by the plugin.

Root Cause

The root cause is a missing authorization check in the plugin's REST route callback. The callback accepts a post type identifier as input and passes it directly to a query without validating that the post type's registration flags permit public reading. The plugin conflates "published" status with "publicly viewable", omitting the check against get_post_type_object()->public.

Attack Vector

An unauthenticated remote attacker sends a crafted request to the vulnerable Essential Blocks REST endpoint. The request specifies the name of a non-public custom post type registered on the target site. The plugin returns published entries of that post type in the response body. Attackers who do not know the exact post type name can enumerate common naming conventions or scrape values from HTML source, sitemaps, and plugin identifiers.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-13154

Indicators of Compromise

Unauthenticated GET requests to Essential Blocks REST routes containing a post_type or equivalent parameter referencing custom post type slugs
HTTP 200 responses returning JSON payloads for post types normally hidden from anonymous users
Repeated requests from a single source enumerating multiple post type identifiers

Detection Strategies

Inspect web server access logs for requests targeting /wp-json/ routes registered by the Essential Blocks plugin
Correlate high-volume REST API queries against custom post type names with the absence of authenticated session cookies
Compare returned post types with the site's registered post type visibility flags to identify improper disclosure

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a central analytics platform
Alert on anonymous access patterns that return non-empty results for non-public post types
Track version metadata of the Gutenberg Essential Blocks plugin across managed WordPress instances

How to Mitigate CVE-2026-13154

Immediate Actions Required

Upgrade the Gutenberg Essential Blocks plugin to version 6.4.0 or later on all WordPress instances
Audit custom post types registered with public => false to confirm no sensitive data was disclosed prior to patching
Review REST API access logs for the period preceding the upgrade to identify potential exploitation attempts

Patch Information

The vendor addressed the issue in Gutenberg Essential Blocks version 6.4.0. The fix adds a check that rejects requests referencing post types that are not publicly viewable. Site owners should apply the update through the WordPress plugin manager or via WP-CLI using wp plugin update essential-blocks.

Workarounds

Deactivate the Gutenberg Essential Blocks plugin until the patched version can be deployed
Restrict access to /wp-json/ endpoints exposed by the plugin at the web application firewall or reverse proxy layer
Move highly sensitive data out of WordPress custom post types and into storage systems with stronger access controls

bash

# Update the plugin using WP-CLI
wp plugin update essential-blocks --version=6.4.0
wp plugin get essential-blocks --field=version