CVE-2026-2371: WordPress Greenshift Auth Bypass Flaw

CVE-2026-2371 Overview

The Greenshift – animation and page builder blocks plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to, and including, 12.8.3. This security flaw exists due to missing authorization and post status validation in the gspb_el_reusable_load() AJAX handler function. The vulnerable handler accepts an arbitrary post_id parameter and renders the content of any wp_block post without performing proper access control checks via current_user_can('read_post', $post_id) or verifying post status.

The vulnerability is further exacerbated because the nonce required for the AJAX request is exposed to unauthenticated users on any public page that uses the [wp_reusable_render] shortcode with the ajax="1" attribute. This exposure enables unauthenticated attackers to retrieve the rendered HTML content of private, draft, or password-protected reusable blocks.

Critical Impact

Unauthenticated attackers can access sensitive content from private, draft, and password-protected WordPress reusable blocks without any authentication, potentially exposing confidential information intended to remain hidden.

Affected Products

• Greenshift – animation and page builder blocks plugin for WordPress versions up to and including 12.8.3
• WordPress installations utilizing the vulnerable Greenshift plugin with AJAX-enabled reusable blocks
• Sites using the [wp_reusable_render] shortcode with ajax="1" attribute

Discovery Timeline

• 2026-03-07 - CVE CVE-2026-2371 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-2371

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization). The core issue stems from the gspb_el_reusable_load() function in the plugin's settings.php file failing to implement proper authorization checks before rendering post content. When a WordPress plugin processes AJAX requests, it should validate that the requesting user has permission to access the requested resource. In this case, the handler blindly accepts any post_id parameter and returns the rendered content without verifying user capabilities or post status.

The attack surface is widened by the plugin's design decision to expose the security nonce on public-facing pages. Nonces in WordPress are intended to provide CSRF protection and verify intent, but they are not meant to serve as an authentication mechanism. By making the nonce available to unauthenticated visitors through the shortcode output, the plugin effectively removes any barrier to exploiting this IDOR vulnerability.

Root Cause

The root cause of this vulnerability is the absence of authorization logic within the gspb_el_reusable_load() AJAX handler. The function located in settings.php processes requests without calling current_user_can('read_post', $post_id) to verify the requesting user has appropriate permissions to view the content. Additionally, the handler does not validate the post status (draft, private, password-protected) before rendering and returning the block content.

The secondary contributing factor is the exposure of the AJAX nonce to unauthenticated users via the [wp_reusable_render] shortcode when configured with ajax="1". This design flaw provides attackers with the token needed to submit valid AJAX requests.

Attack Vector

An attacker can exploit this vulnerability remotely via network access without requiring any authentication or user interaction. The attack flow involves:

1. Visiting any public page on the target WordPress site that uses the [wp_reusable_render] shortcode with AJAX enabled
2. Extracting the exposed nonce value from the page source
3. Crafting AJAX requests to the gspb_el_reusable_load endpoint with arbitrary post_id values
4. Iterating through post IDs to discover and retrieve private, draft, or password-protected reusable blocks

The vulnerability allows attackers to enumerate and access content that site administrators intended to keep confidential, including unpublished drafts, internal documentation stored in reusable blocks, or content protected by passwords.

Detection Methods for CVE-2026-2371

Indicators of Compromise

• Unusual volume of AJAX requests to admin-ajax.php with the gspb_el_reusable_load action from unauthenticated sessions
• Sequential or enumerated post_id parameters in AJAX requests indicating reconnaissance activity
• Access logs showing requests for wp_block post types from external IP addresses without corresponding authentication
• Multiple requests from single IP addresses attempting to access various post IDs in rapid succession

Detection Strategies

• Monitor web server access logs for patterns of AJAX requests targeting the gspb_el_reusable_load action
• Implement rate limiting on admin-ajax.php endpoints to detect enumeration attempts
• Configure web application firewall (WAF) rules to alert on suspicious patterns of post ID enumeration
• Review WordPress audit logs for unauthorized access attempts to draft or private content

Monitoring Recommendations

• Deploy log aggregation to centralize and analyze WordPress AJAX request patterns
• Establish baseline metrics for normal AJAX traffic and alert on anomalous increases
• Configure real-time alerting for access attempts to sensitive post types from unauthenticated sessions
• Implement SentinelOne Singularity platform monitoring on web servers to detect exploitation patterns and anomalous process behavior

How to Mitigate CVE-2026-2371

Immediate Actions Required

• Update the Greenshift – animation and page builder blocks plugin to the latest patched version immediately
• Audit existing WordPress installations to identify sites using affected versions of the plugin
• Review reusable blocks for sensitive content and assess potential exposure
• Temporarily disable the ajax="1" attribute on [wp_reusable_render] shortcodes until patches are applied

Patch Information

The vulnerability has been addressed in versions after 12.8.3. The fix implements proper authorization checks within the gspb_el_reusable_load() function to verify user capabilities before rendering post content. Technical details of the code changes can be reviewed in the WordPress Plugin Changeset #3465111.

Additional technical references:

• Wordfence Vulnerability Report
• WordPress Plugin Settings Line 1630
• WordPress Plugin Settings Line 1674

Workarounds

• Disable AJAX functionality on reusable block shortcodes by removing ajax="1" attribute
• Implement server-level access controls to restrict admin-ajax.php requests from unauthenticated users where feasible
• Deploy a web application firewall (WAF) with rules to block suspicious enumeration patterns
• Consider temporarily deactivating the Greenshift plugin until patching is complete if sensitive content is at risk

# Check installed Greenshift plugin version
wp plugin list --name=greenshift-animation-and-page-builder-blocks --fields=name,version,status

# Update to the latest patched version
wp plugin update greenshift-animation-and-page-builder-blocks

# Verify update was successful
wp plugin list --name=greenshift-animation-and-page-builder-blocks --fields=name,version,status