Security Alert Summary
The GenerateBlocks plugin for WordPress has an Insecure Direct Object Reference vulnerability in its dynamic tag replacements REST endpoint. Authenticated users with Contributor-level access or higher may be able to retrieve sensitive information from posts, such as author email addresses and certain non-protected post meta values, because the endpoint fails to perform object-level authorization checks.
CVE Details
- CVE ID: CVE-2026-3454
- Affected component: GenerateBlocks plugin (dynamic tag replacements REST endpoint)
- Affected versions: All versions up to and including 2.2.0
- Published: May 5, 2026 at 7:16 AM UTC
- Last modified: May 5, 2026 at 7:16 AM UTC
- CVSS v3.1 base score: 6.5 (MEDIUM)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Authentication / Privileges / User interaction: Requires an authenticated user with low privileges (Contributor-level access or higher). No user interaction required.
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness: CWE-639 (Insecure Direct Object Reference)
Technical Details
The vulnerability exists in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint verifies that the requester has the edit_posts capability but fails to perform object-level authorization checks to confirm the requesting user is allowed to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content.
Because checks that validate access to the targeted post or post meta are missing in the dynamic tag callbacks and related meta handling code, an authenticated user with Contributor-level privileges or higher can craft dynamic tag payloads that reference arbitrary post IDs and read certain data from those posts. The description identifies the relevant plugin files and callback logic where these checks are missing (see references for the code paths).
The impact is limited to disclosure of readable data from posts and post meta that are not otherwise protected. The vulnerability does not indicate modification or deletion of content, nor does it indicate a direct availability impact.
How This Could Impact Your Website
Consider a small site with a site owner, one or more editors, and external contributors or contractors who post content. An attacker who has a Contributor account could use the vulnerable dynamic tag endpoint to retrieve author email addresses and non-protected post meta values from posts they should not be able to read. This could expose internal email addresses or metadata used for editorial workflows.
Practical consequences include increased risk of targeted phishing or social engineering against staff and contractors, and exposure of information that might be used to infer internal processes. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor accounts and other low-privilege accounts that can create or edit posts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, such as unexpected REST API requests or repeated attempts to access content by non-privileged accounts.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-meta-handler.php#L335
- https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tag-callbacks.php#L364
- https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tag-callbacks.php#L64
- https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tags.php#L392
- https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tags.php#L424
- https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tags.php#L501
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3495827%40generateblocks%2Ftrunk&old=3415721%40generateblocks%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0297d524-e016-4f8d-920c-d58c62edb2a0?source=cve
