CVE-2026-2371: Greenshift WordPress Auth Bypass Flaw

CVE-2026-2371 Overview

CVE-2026-2371 affects the Greenshift animation and page builder blocks plugin for WordPress in all versions up to and including 12.8.3. The vulnerability is an Insecure Direct Object Reference [CWE-862] in the gspb_el_reusable_load() AJAX handler. The handler accepts an arbitrary post_id parameter and renders any wp_block post without checking current_user_can('read_post', $post_id) or validating the post status. When a public page uses the [wp_reusable_render] shortcode with ajax="1", the required nonce is exposed to unauthenticated visitors. Unauthenticated attackers can retrieve the rendered HTML content of private, draft, or password-protected reusable blocks.

Critical Impact
Unauthenticated attackers can read the rendered HTML of private, draft, or password-protected wp_block reusable blocks on affected WordPress sites.

Affected Products

Greenshift – animation and page builder blocks plugin for WordPress
All versions up to and including 12.8.3
WordPress sites exposing pages with the [wp_reusable_render] shortcode configured with ajax="1"

Discovery Timeline

2026-03-07 - CVE-2026-2371 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-2371

Vulnerability Analysis

The flaw resides in the gspb_el_reusable_load() AJAX handler registered by the Greenshift plugin. The handler reads a caller-supplied post_id parameter and returns the rendered output of the corresponding wp_block custom post type. The handler omits two essential checks: it never calls current_user_can('read_post', $post_id) to confirm the requester is permitted to read the target post, and it does not verify the post status. As a result, the handler treats private, draft, pending, and password-protected posts identically to public posts.

The issue is amplified by nonce exposure. When a site embeds the [wp_reusable_render] shortcode with ajax="1" on any public page, WordPress prints the AJAX nonce into the page source for unauthenticated visitors. An attacker scrapes that nonce, then iterates post_id values against the AJAX endpoint to harvest content that should remain restricted. The disclosure is limited to information confidentiality, with no integrity or availability impact.

Root Cause

The root cause is missing authorization combined with missing post status validation in a single AJAX entry point. The handler trusts the post_id argument and renders block content without enforcing the WordPress capability model on the requesting user.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker locates a public page that renders the [wp_reusable_render] shortcode in AJAX mode, extracts the embedded nonce, and issues admin-ajax.php requests with the gspb_el_reusable_load action and an arbitrary post_id. The endpoint returns the rendered HTML of the requested reusable block regardless of its visibility status.

No verified proof-of-concept code is published. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Changeset.

Detection Methods for CVE-2026-2371

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php carrying action=gspb_el_reusable_load with varying post_id values.
High volume or sequential enumeration of post_id parameters from a single source address.
Access log entries showing successful 200 responses to the gspb_el_reusable_load action from clients that never authenticated.

Detection Strategies

Inspect WordPress access logs for the string gspb_el_reusable_load in request bodies or query strings.
Correlate AJAX requests with WordPress user session cookies to flag unauthenticated callers receiving non-empty responses.
Compare requested post_id values against the database to identify access attempts targeting wp_block posts with non-publish status.

Monitoring Recommendations

Enable a WordPress security plugin or web application firewall (WAF) that logs and rate-limits admin-ajax.php traffic per source IP.
Alert on unauthenticated AJAX responses larger than a defined baseline for the gspb_el_reusable_load action.
Track plugin version inventory across WordPress fleets and flag any instance running Greenshift 12.8.3 or earlier.

How to Mitigate CVE-2026-2371

Immediate Actions Required

Update the Greenshift plugin to a version newer than 12.8.3 that contains the fix introduced in changeset 3465111.
Audit all pages that use the [wp_reusable_render] shortcode with ajax="1" and remove the shortcode if the patched version cannot be deployed immediately.
Review the content of all wp_block posts marked private, draft, or password-protected for sensitive material that may already be exposed.

Patch Information

The vendor addressed the issue in the Greenshift plugin via changeset 3465111, which adds authorization and post status validation to the gspb_el_reusable_load() handler. Refer to the Wordfence Vulnerability Report for the fixed version number.

Workarounds

Remove the [wp_reusable_render] shortcode with ajax="1" from public-facing pages until the plugin is updated.
Deploy a WAF rule that blocks unauthenticated admin-ajax.php requests containing action=gspb_el_reusable_load.
Restrict access to /wp-admin/admin-ajax.php for unauthenticated users where business requirements allow.

bash

# Example WAF rule (ModSecurity) blocking unauthenticated calls to the vulnerable action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1002371,msg:'Block CVE-2026-2371 Greenshift IDOR'"
  SecRule ARGS:action "@streq gspb_el_reusable_load" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"