Insecure Direct Object Reference in Static Block Plugin for WordPress

CVE-2026-10780

What is CVE-2026-10780?

The Static Block plugin for WordPress poses a security risk due to an Insecure Direct Object Reference. In all versions up to and including 2.2, the plugin allows authenticated users with contributor-level access and above to access the content of arbitrary posts. This vulnerability arises from the static_block_content() shortcode handler, which retrieves a post using a user-supplied 'id' without properly checking the post's status (private, draft, pending) or the user's viewing capabilities. This oversight enables attackers to potentially view private and draft static blocks, compromising the confidentiality of content intended only for specific users.

References