Executive brief
The Static Block plugin for WordPress, which allows users to create reusable content blocks, contains a security flaw that allows lower-level users to view restricted content. An attacker with a contributor account could use this vulnerability to read private drafts or sensitive posts created by administrators. This could lead to the unauthorized disclosure of confidential business information or internal site data.
Technical details
The Static Block plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the static_block_content() shortcode handler. The vulnerability exists because the handler uses the get_post() function with an attacker-supplied 'id' attribute without verifying the post's status (e.g., private, draft, pending) or checking if the requesting user has the appropriate permissions to view that specific post. Authenticated attackers with contributor-level access or higher can exploit this by embedding the [static_block_content id="X"] shortcode into their own content and previewing it. This allows for the unauthorized retrieval of post_content from arbitrary post IDs, including those belonging to other users or containing sensitive administrative drafts.
Affected products
- WordPress Plugin Static Block up to, and including, 2.2
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
References
- https://plugins.trac.wordpress.org/browser/static-block/trunk/static-block.php
- https://plugins.trac.wordpress.org/browser/static-block/trunk/static-block.php
- https://plugins.trac.wordpress.org/browser/static-block/trunk/static-block.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f88c00ca-cf9e-44e7-9495-686ace1ead21?source=cve