Insecure Direct Object Reference in GenerateBlocks Plugin for WordPress

CVE-2026-3454

What is CVE-2026-3454?

The GenerateBlocks plugin for WordPress is exposed to an Insecure Direct Object Reference vulnerability affecting all versions up to and including 2.2.0. This vulnerability arises from the lack of object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. While the endpoint ensures the user has the edit_posts capability, it fails to authenticate the specific permissions necessary to access posts or associated data referenced by attacker-controlled parameters. As a result, authenticated users with Contributor-level access and higher can exploit this weakness to extract sensitive data, including author email addresses and non-protected post meta values, by crafting dynamic tag payloads like {{post_meta id:|key:<meta_key>}} and {{post_title id:|link:author_email}}.

References