Nexter Blocks CVE-2026-39516

While the CVSS base score of 5.3 registers as moderate severity, multiple risk signals suggest lower real-world priority. The EPSS exploitation probability of 0.02% (5th percentile) represents minimal likelihood of active exploitation in the wild. No CISA KEV status is indicated, and no public proof-of-concept code has been identified in the provided data. The vulnerability is classified as information disclosure rather than code execution or authentication bypass, limiting the immediate attack impact to confidentiality loss of sensitive system data (e.g., plugin versions, configuration details). However, exposed system information can facilitate reconnaissance for secondary attacks; organizations should prioritize patching based on whether this WordPress instance handles high-value data (payment processing, user PII) that could be combined with additional vulnerabilities.

An unauthenticated attacker sends a crafted HTTP request to an unprotected API endpoint or data exposure point in the Nexter Blocks plugin, retrieving embedded sensitive data such as plugin configuration, system paths, or metadata without providing credentials. This reconnaissance data can then be used to identify additional vulnerabilities or weaknesses in the WordPress installation for subsequent attacks.