The Gutenberg Essential Blocks WordPress plugin before 6.4.0 is vulnerable to unauthenticated access, allowing users to read published entries of custom post types that the site registered as non-public. This issue arises from the plugin's failure to verify the public viewability of attacker-supplied post types in its public REST routes. The CVE record was published on 2026-08-06T07:16:27.207Z and has not [truncated]
HIGHGutenberg Essential BlocksCVE published 2026-08-06
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product. This issue is rated HIGH with a CVSS score of 7.5. Affected product deployments should be reviewed for [truncated]
