CVE-2026-86783: Post Grid Gutenberg Blocks Information Disclosure

CVE-2026-86783 Overview

CVE-2026-86783 is an information disclosure vulnerability in The Post Grid Gutenberg Blocks WordPress plugin versions before 5.0.41. The plugin exposes a REST API route that returns custom field key names of arbitrary posts without performing authorization or post-visibility checks. Unauthenticated attackers can query the endpoint and enumerate custom field keys for private, draft, pending, scheduled, and password-protected posts. The vulnerability is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate custom field key names of non-public WordPress posts, exposing internal metadata that should remain protected.

Affected Products

The Post Grid Gutenberg Blocks WordPress plugin versions prior to 5.0.41
WordPress installations with the plugin active and REST API enabled
Sites relying on the plugin for post display and custom field rendering

Discovery Timeline

2026-09-23 - CVE-2026-86783 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86783

Vulnerability Analysis

The Post Grid Gutenberg Blocks plugin registers a REST API route that returns the list of custom field keys associated with a given post identifier. The route handler does not verify whether the requesting user has permission to view the target post. It also does not consult WordPress post status or visibility settings before returning data.

An unauthenticated attacker sends an HTTP request to the vulnerable REST endpoint with a target post ID. The endpoint returns the custom field key names regardless of the post's status. This includes posts in private, draft, pending, future (scheduled), and password-protected states.

Custom field keys frequently reveal internal workflow data, integration identifiers, API references, editorial notes, and plugin-specific metadata. Attackers can use disclosed keys to fingerprint installed extensions and plan follow-on attacks against related endpoints.

Root Cause

The root cause is a missing authorization check in the REST API permission_callback. WordPress requires developers to implement a permission_callback that validates the caller's capabilities against the target resource. In this plugin, the callback returns permissive results without invoking current_user_can('read_post', $post_id) or an equivalent visibility check.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker issues an HTTP GET request to the plugin's REST route, supplying post identifiers to enumerate. The server responds with the custom field key names for each requested post. No authentication, user interaction, or elevated privileges are required. The attacker can script bulk enumeration across sequential post IDs to harvest metadata site-wide.

For technical detail on the vulnerable route, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-86783

Indicators of Compromise

Repeated unauthenticated requests to /wp-json/ routes registered by The Post Grid Gutenberg Blocks plugin
Sequential post ID enumeration patterns from a single source IP
Unusual REST API response volumes correlated with post ID iteration
Requests referencing custom field or meta endpoints without valid authentication cookies

Detection Strategies

Review web server and WordPress access logs for high-frequency requests to plugin REST namespaces
Enable REST API request logging and alert on unauthenticated calls that return non-empty payloads for private posts
Deploy a Web Application Firewall (WAF) rule that flags anonymous access to plugin-specific REST routes

Monitoring Recommendations

Ingest WordPress and reverse proxy logs into a centralized SIEM for correlation across sites
Monitor for anomalous outbound REST API scanning of wp-json namespaces
Track plugin version inventory across WordPress deployments to identify unpatched instances

How to Mitigate CVE-2026-86783

Immediate Actions Required

Upgrade The Post Grid Gutenberg Blocks plugin to version 5.0.41 or later on all WordPress sites
Audit REST API access logs for prior enumeration attempts against the vulnerable endpoint
Restrict unauthenticated access to plugin REST routes at the WAF or reverse proxy layer until patched

Patch Information

The vendor addressed the missing authorization check in version 5.0.41 of The Post Grid Gutenberg Blocks WordPress plugin. Administrators should install this release through the WordPress plugin updater or by deploying the updated plugin package. Verify the installed version after upgrade and confirm the vulnerable REST route now rejects anonymous requests for non-public posts.

Workarounds

Disable The Post Grid Gutenberg Blocks plugin until the update to 5.0.41 can be applied
Block unauthenticated requests to the plugin's REST namespace using WAF rules or .htaccess restrictions
Restrict WordPress REST API access to authenticated users where site functionality permits

bash

# Example WAF rule blocking anonymous access to the plugin REST namespace
# Adjust the location prefix to match the plugin route observed in the advisory
location ~ ^/wp-json/post-grid/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}