CVE-2026-118801

Name of the Vulnerable Software and Affected Versions aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder versions prior to 2.18.1

Description Sensitive information exposure occurs via the id parameter. Authenticated attackers with contributor-level access or higher can extract the full rendered body content of any password-protected post across any post type by embedding a shortcode with the target post's ID. Furthermore, attackers with author-level access or higher can publish a post containing this shortcode, which exposes the password-protected content to unauthenticated visitors.

Recommendations Update the plugin to a version later than 2.18.0.