Information Exposure in GenerateBlocks Plugin for WordPress

CVE-2025-12512

What is CVE-2025-12512?

The GenerateBlocks plugin for WordPress allows authenticated users with Contributor-level access to exploit a lack of object-level authorization checks, leading to the potential exposure of personally identifiable information (PII). Versions up to 2.1.2 permit unauthorized access to sensitive user metadata via multiple REST API routes under generateblocks/v1/meta/, enabling attackers to retrieve data such as names, email addresses, phone numbers, and physical addresses. This vulnerability exposes users to risks associated with targeted phishing, pretexting for account takeovers, and violations of privacy.

References