Insecure Direct Object Reference in Greenshift Animation and Page Builder Blocks for WordPress

CVE-2026-2371

What is CVE-2026-2371?

The Greenshift Animation and Page Builder Blocks plugin for WordPress has a vulnerability that allows unauthenticated users to access sensitive content. The issue arises from a misspecified AJAX handler, gspb_el_reusable_load(), which fails to validate user permissions and post status when processing requests for specific block content. As a result, any user can exploit the vulnerability to retrieve HTML content from private, draft, or password-protected blocks via an arbitrary post_id, exposing crucial elements of the site and compromising content security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References