What the vulnerability does
01Description
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and get_siteinfo functions in all versions up to, and including, 5.7.2. This makes it possible for authenticated attackers, with Author-level access and above, to view API keys configured for the external services.
Explanation of Vulnerability in Simple Terms
02Summary
The Gutenberg Essential Blocks plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to read sensitive data they should not access. The vulnerability affects all versions up to 5.7.2. An attacker needs a valid WordPress account to exploit it, but no special interaction is required. Site administrators should update to a version newer than 5.7.2.
What an attacker can do
03Attacker Capabilities
Read sensitive data accessible to higher-privilege users without proper authorization checks.
Potential impact on your site
04Site Impact
Unauthorized users can access confidential information stored in the plugin, potentially exposing site data.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level privileges.
Key dates
06Disclosure timeline
December 17, 2025
CVE published
April 8, 2026
Record updated
