Executive brief
Gutentor is a popular page builder plugin for WordPress that allows content creators to design pages using blocks. A flaw in its REST API endpoint fails to restrict access properly, allowing any logged-in user with a basic Subscriber account to retrieve plaintext passwords of password-protected posts. This exposes sensitive content access credentials to low-privilege attackers, potentially compromising member-only or restricted content.
Technical details
The Gutentor plugin's REST API endpoint `/wp-json/gutentor-self-api/v1/get_posts` fails to apply correct context restrictions when returning post data. The endpoint gates access only on the 'read' capability (available to Subscribers) but unconditionally includes the `post_password` field in responses, unlike WordPress core REST API which exposes this field only in edit context. An authenticated attacker with Subscriber role can call this endpoint with a valid nonce to retrieve plaintext passwords for all password-protected posts. The vulnerability requires authentication (user must have a valid WordPress account) but no elevated privileges. The issue is resolved in version 4.0.6.
Affected products
- WordPress.org Gutentor before 4.0.6
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 4.0.6