Post Grid Gutenberg EUVD-2026-85045

No special conditions - remote unauthenticated exploitation against default configurations of the Post Grid Gutenberg Blocks WordPress plugin (versions before 5.0.41). The only prerequisite is that the target site runs the vulnerable plugin version and the attacker knows or enumerates valid post IDs. The vulnerable REST API route performs no authorization or post-visibility check, so no authentication, user interaction, or non-default setting is required. The limiting factor is impact scope, not access: only custom field KEY NAMES are returned (not values or content), so the disclosure is reconnaissance-grade metadata rather than sensitive data exposure.

This is a genuine but low-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) is internally consistent with the description: a remote, unauthenticated attacker over the network can trigger the flaw with no user interaction against default configurations, but the only impact is limited confidentiality (C:L) - disclosure of custom field KEY NAMES, not their values or the post content itself. No EPSS score, KEV listing, or public POC is provided in the input, so per the precision rules this is 'no public exploit identified at time of analysis.' No SSVC decision data is supplied. The realistic priority is low-to-moderate: while trivially exploitable and unauthenticated, the information leaked (metadata key names of private/draft/pending/scheduled/password-protected posts) is reconnaissance-grade only - useful for mapping a site's schema or chaining into other attacks, not directly damaging. Patch availability makes remediation straightforward. No signals conflict; the vector and description align cleanly.

An unauthenticated attacker sends a crafted request to the plugin's unprotected REST API route, supplying the ID of a private, draft, or password-protected post, and receives back the custom field key names attached to that post despite having no rights to view it. This enables reconnaissance of hidden content structure (e.g., discovering meta keys that hint at premium content, internal workflows, or integrations). No public POC is referenced in the provided data.