What is the CVSS score of CVE-2026-13153?

CVE-2026-13153 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Gutenberg Essential Blocks are affected by CVE-2026-13153?

Gutenberg Essential Blocks for WordPress versions prior to 6.4.0 expose WooCommerce product sales metrics to the public internet without authentication, allowing competitors and threat actors to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-13153?

Yes, a public proof-of-concept exploit is available for CVE-2026-13153. Prioritise patching immediately. EPSS: 0.1%.

Gutenberg Essential Blocks CVE-2026-13153

Q: How to fix or mitigate CVE-2026-13153?

Within 24 hours, identify all WordPress instances running Gutenberg Essential Blocks and determine which are actively using WooCommerce; if unpatched, immediately restrict REST API access to the plugin via WordPress security plugins or web application firewall rules. Within 7 days, upgrade Gutenberg Essential Blocks to version 6.4.0 or later on all affected WordPress installations. Within 30 days, conduct an audit of WooCommerce product data access logs (if available) to determine whether unauthorized queries occurred, and consider implementing broader REST API access controls to prevent similar exposures in future plugins.

EUVD-2026-53735 HIGH

Information Exposure (CWE-200)

2026-08-06 WPScan

GHSA-x777-p9m5-h8hq

WordPress Information Disclosure Gutenberg Essential Blocks Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible REST endpoint, no auth required, no interaction needed; confidentiality impact is High for non-public business sales metrics with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:27 vuln.today

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.

AnalysisAI

Unauthenticated information disclosure in Gutenberg Essential Blocks for WordPress (versions before 6.4.0) exposes WooCommerce per-product lifetime sales unit counts to any internet user via an unrestricted public REST API route. The plugin over-fetches a non-public WooCommerce metric and surfaces it in the REST response without access control enforcement, meaning competitors, scrapers, or threat actors can query sales volumes for any published product on affected stores. A publicly available proof-of-concept exploit exists per WPScan, and SSVC assessment confirms the attack is automatable; however, EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation at time of analysis.

Technical ContextAI

The vulnerability resides in the WordPress REST API integration layer of the Gutenberg Essential Blocks plugin (CPE: cpe:2.3:a:unknown:gutenberg_essential_blocks:*:*:*:*:*:*:*:*), a Gutenberg block builder that extends WordPress with WooCommerce-aware components. WordPress exposes REST API endpoints that can be public or protected; this plugin registers a route without enforcing capability checks or authentication guards, a common pattern error in WordPress plugin development. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the endpoint pulls a WooCommerce internal sales metric - lifetime units sold per product - which WooCommerce deliberately gates behind authentication, but the plugin re-exposes it through its own unprotected route. The attack surface is entirely remote and requires no WordPress account.

RemediationAI

Update Gutenberg Essential Blocks to version 6.4.0 or later, which is the vendor-released patch that restricts access to the previously public REST route. The fix should be applied immediately on any WordPress installation running WooCommerce alongside this plugin. There is no confirmed safe workaround short of patching; disabling the specific REST route via a mu-plugin or WAF rule blocking the vulnerable endpoint path is a viable interim compensating control if immediate upgrade is not possible, though this may break legitimate block functionality that depends on the route. Site administrators can also use a WAF rule to block unauthenticated requests to the affected REST namespace as a short-term measure. Patch version confirmed via WPScan advisory: https://wpscan.com/vulnerability/0401a229-9630-49ab-ae4b-53360cf5d109/.