Authorization Bypass in Post Grid Gutenberg Blocks Plugin by WordPress
CVE-2026-86783
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86783?
The Post Grid Gutenberg Blocks plugin for WordPress allows unauthenticated users to query a REST API endpoint that exposes the custom field keys of posts without sufficient authorization checks. This vulnerability can lead to the unintentional disclosure of sensitive data, including the keys of private, draft, pending, scheduled, and password-protected posts, thereby increasing the risk of unauthorized access to confidential information.
Affected Version(s)
Post Grid Gutenberg Blocks 0 < 5.0.41
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.