Is CVE-2026-10780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10780 being exploited in the wild.

How severe is CVE-2026-10780?

Medium severity, with a CVSS score of 4.3, published 16 June 2026.

Which products and versions are affected?

WordPress Plugin Static Block Static Block up to, and including, 2.2.

Is there a fix for CVE-2026-10780?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10780 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10780?

Check whether you run WordPress Plugin Static Block Static Block at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10780: WordPress Static Block IDOR in static_block_content shortcode

CVE-2026-10780 · Severity: medium · CVSS 4.3 · Published 2026-06-16

The Static Block plugin for WordPress, which allows users to create reusable content blocks, contains a security flaw that allows lower-level users to view restricted content. An attacker with a contributor account could use this vulnerability to read private drafts or sensitive posts created by administrators. This could lead to the unauthorized disclosure of confidential business information or internal site data.

Quick answers

Is CVE-2026-10780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10780 being exploited in the wild.
How severe is CVE-2026-10780?: Medium severity, with a CVSS score of 4.3, published 16 June 2026.
Which products and versions are affected?: WordPress Plugin Static Block Static Block up to, and including, 2.2.
Is there a fix for CVE-2026-10780?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10780 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10780?: Check whether you run WordPress Plugin Static Block Static Block at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Static Block plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the static_block_content() shortcode handler. The vulnerability exists because the handler uses the get_post() function with an attacker-supplied 'id' attribute without verifying the post's status (e.g., private, draft, pending) or checking if the requesting user has the appropriate permissions to view that specific post. Authenticated attackers with contributor-level access or higher can exploit this by embedding the [static_block_content id="X"] shortcode into their own content and previewing it. This allows for the unauthorized retrieval of post_content from arbitrary post IDs, including those belonging to other users or containing sensitive administrative drafts.

Affected products

WordPress Plugin Static Block up to, and including, 2.2

Timeline

2026-06-16: disclosed
2026-06-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.