Executive brief
The Post Grid Gutenberg Blocks WordPress plugin fails to validate user permissions on a REST API endpoint, allowing anyone on the internet to discover the names of custom data fields attached to private, draft, and password-protected posts. An attacker can enumerate sensitive custom field names to understand the structure of protected content or prepare for further attacks.
Technical details
The plugin's REST API route lacks authorization and post-visibility checks, exposing the custom field keys of any post regardless of its publication status. The vulnerability is a network-accessible information disclosure requiring no authentication, affecting all versions before 5.0.41.
Affected products
- WordPress Post Grid Gutenberg Blocks before 5.0.41
Timeline
- 2026-09-21: disclosed