What is the CVSS score of EUVD-2026-53736?

EUVD-2026-53736 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Gutenberg Essential Blocks are affected by EUVD-2026-53736?

The Gutenberg Essential Blocks WordPress plugin (versions before 6.4.0) exposes non-public custom post type content through an unauthenticated API bypass, potentially disclosing sensitive data to…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-53736?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53736. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-53736?

Within 24 hours, scan for affected WordPress instances running Gutenberg Essential Blocks and audit which sites have custom post types configured as private or non-public; review REST API access logs for suspicious queries to post type endpoints. Within 7 days, deploy Gutenberg Essential Blocks version 6.4.0 or later across all affected sites. Within 30 days, conduct a comprehensive audit of custom post type visibility settings to ensure no unintended content remains accessible, and implement monitoring for anomalous REST API access patterns.

Gutenberg Essential Blocks EUVD-2026-53736

| CVE-2026-13154 HIGH

Information Exposure (CWE-200)

2026-08-06 WPScan

GHSA-45qh-hqj8-xp45

WordPress Information Disclosure Gutenberg Essential Blocks Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible REST endpoint, no authentication or interaction required; impact is confidentiality-only with no modification or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:26 vuln.today

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.

AnalysisAI

Unauthenticated information disclosure in the Gutenberg Essential Blocks WordPress plugin before 6.4.0 exposes published content from custom post types that site administrators deliberately registered as non-public. The plugin's public REST API route queries arbitrary post types supplied by the caller without first verifying their visibility setting, bypassing the access control intent of the post type registration. A publicly available proof-of-concept exists; EPSS sits at 0.14% (4th percentile) suggesting exploitation remains rare despite automatable conditions, and the vulnerability is not currently listed in the CISA KEV catalog.

Technical ContextAI

WordPress allows developers to register custom post types with the 'public' flag set to false, which is intended to prevent those types from appearing in the REST API and standard queries - a common pattern for internal data models, draft workflows, or application-specific records. The Gutenberg Essential Blocks plugin (CPE: cpe:2.3:a:unknown:gutenberg_essential_blocks:*:*:*:*:*:*:*:*) exposes at least one REST endpoint that accepts a caller-supplied post type parameter and queries it directly without checking whether WordPress considers it publicly viewable. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), driven by a missing authorization check on a query parameter at the REST route handler level. The endpoint is inherently unauthenticated and network-accessible, matching the CVSS vector AV:N/AC:L/PR:N/UI:N.

RemediationAI

Update the Gutenberg Essential Blocks WordPress plugin to version 6.4.0 or later, which contains the vendor-released patch for this vulnerability. The fix should enforce a post-type visibility check before executing the REST query. If an immediate update is not possible, a compensating control is to restrict access to WordPress REST API endpoints at the web server or WAF layer - for example, by blocking unauthenticated requests to /wp-json/ routes - though this may break legitimate plugin functionality for frontend block rendering and should be tested carefully. Alternatively, site operators can audit their registered non-public custom post types and evaluate whether any contain data that would be harmful if exposed, prioritizing patching for those sites. No permanent workaround replaces the patch; WAF rules are a temporary measure only. Advisory references: https://wpscan.com/vulnerability/ab60ebee-c8b5-4bba-8138-2083ca14546a/