What the vulnerability does
01Description
The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint only verifies that the user has the edit_posts capability but does not verify the user has permission to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information from arbitrary posts including author email addresses and non-protected post meta values by crafting dynamic tag payloads such as {{post_meta id:<target>|key:<meta_key>}} and {{post_title id:<target>|link:author_email}}.
Explanation of Vulnerability in Simple Terms
02Summary
GenerateBlocks versions 2.2.0 and earlier contain an authorization flaw that allows authenticated users to read sensitive data they should not have access to. The vulnerability requires a valid user account but no special privileges. An attacker with low-level access can retrieve confidential information from the site. Update to version 2.3.0 or later to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive data or information they are not authorized to access.
Potential impact on your site
04Site Impact
Authenticated users can access confidential data beyond their permission level, risking data exposure.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges on the site.
Key dates
06Disclosure timeline
May 5, 2026
CVE published
May 5, 2026
Record updated
