What is the CVSS score of CVE-2026-3454?

CVE-2026-3454 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

GenerateBlocks WordPress Plugin CVE-2026-3454

EUVD-2026-27225 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-05 Wordfence

GHSA-6288-wf2g-3fwm

Authentication Bypass WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 07:30 vuln.today

DescriptionCVE.org

The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint only verifies that the user has the edit_posts capability but does not verify the user has permission to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information from arbitrary posts including author email addresses and non-protected post meta values by crafting dynamic tag payloads such as {{post_meta id:<target>|key:<meta_key>}} and {{post_title id:<target>|link:author_email}}.

AnalysisAI

GenerateBlocks plugin for WordPress up to version 2.2.0 fails to verify object-level authorization on the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint, allowing authenticated Contributor-level users to extract sensitive information from arbitrary posts including author email addresses and post meta values through crafted dynamic tag payloads. The vulnerability checks only for edit_posts capability but does not verify access to specific posts, exposing confidential data across the entire site to low-privilege authenticated users.

Technical ContextAI

GenerateBlocks is a WordPress page builder plugin that uses dynamic tags (template variables) to insert post data via REST API. The /wp-json/generateblocks/v1/dynamic-tag-replacements endpoint processes dynamic tag syntax such as {{post_meta id:<target>|key:<meta_key>}} and {{post_title id:<target>|link:author_email}}. The vulnerability is rooted in Insecure Direct Object Reference (IDOR, CWE-639), where the REST endpoint accepts attacker-controlled post ID parameters without validating whether the requesting user has permission to read that post. The endpoint relies on WordPress capability checks (edit_posts) but bypasses the post-level access control that WordPress enforces through post_type__in, post__in, and post status filters. This is a classic authorization bypass where capability-level checks are insufficient without object-level validation. The affected code (per Trac references) includes dynamic-tags.php lines 392, 424, 501 and dynamic-tag-callbacks.php lines 64, 364, indicating the authorization gap spans multiple tag processing and callback functions.

RemediationAI

Update GenerateBlocks to a patched version released after 2.2.0. According to the Trac changeset reference (3495827 vs 3415721 in the generateblocks trunk), a fix has been committed upstream. Verify the specific patched version from the vendor and apply the update immediately via WordPress admin dashboard or command line (wp plugin update generateblocks). If a patched release is not yet available, implement a temporary compensating control by restricting REST API access: use a security plugin (e.g., Wordfence, Sucuri) to block the /wp-json/generateblocks/v1/dynamic-tag-replacements endpoint for unauthenticated users, or use .htaccess to rate-limit or restrict that endpoint. Additionally, audit WordPress user accounts and remove unnecessary Contributor-level access; restrict permissions to only users who genuinely need to create/edit content. Monitor post access logs to detect unusual cross-post queries via the REST API. Note that blocking the endpoint may break GenerateBlocks functionality for legitimate users, so test in a staging environment first. For comprehensive protection, also review post meta and author email exposure in other parts of GenerateBlocks and consider disabling the dynamic tag feature temporarily on sensitive sites until a complete patch is applied.