CVE-2026-13154CWE-200information-disclosure
CVE-2026-13154
High · published August 6, 2026
What it is
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00434 · 36.6th percentile
- Weakness
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- Published
- 2026-08-06T11:16Z
References (1)
EPSS history
Timeline