CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint
Unauthenticated attackers can read published content from non-public custom post types via the REST API in the Essential Blocks WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13154?
CVE-2026-13154 is a high-severity vulnerability in Unknown Gutenberg Essential Blocks, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.
Weakness: CWE-200
Which versions are affected by CVE-2026-13154?
How do I fix CVE-2026-13154?
No fix has been published for CVE-2026-13154 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13154 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-13154 exists.
Sources
Also known as GHSA-45qh-hqj8-xp45.