PatchSiren

Gutenberg Essential Blocks CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Gutenberg Essential Blocks CVE published 2026-08-06

CVE-2026-13153

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product. This issue is rated HIGH with a CVSS score of 7.5. Affected product deployments should be reviewed for [truncated]