What the vulnerability does
01Description
The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shortcode handler retrieving a post via get_post() using an attacker-supplied 'id' attribute and outputting its post_content without verifying the post's status (private, draft, pending) or the requesting user's capability to view it. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary posts, including private and draft static blocks (and any other post type) created by administrators, by embedding the [static_block_content id="X"] shortcode in their own content and previewing it.
Explanation of Vulnerability in Simple Terms
02Summary
Static Block versions 2.2 and earlier contain an authorization flaw that allows authenticated users to read sensitive information they should not access. The vulnerability requires a valid user account and network access but no additional user interaction. Site administrators should update to a version newer than 2.2 to mitigate exposure of confidential data.
What an attacker can do
03Attacker Capabilities
Read sensitive information accessible to other users or restricted areas of the site.
Potential impact on your site
04Site Impact
Authenticated users can access confidential data beyond their permission level, risking data exposure.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges on the site.
Key dates
06Disclosure timeline
June 16, 2026
CVE published
