CVE-2026-10780

Name of the Vulnerable Software and Affected Versions Static Block versions prior to 2.3

Description The Static Block plugin for WordPress contains an Insecure Direct Object Reference. This occurs because the static block content() shortcode handler uses the get post() function to retrieve a post based on an attacker-supplied id attribute and outputs the post content without verifying the post status (such as private, draft, or pending) or the user's permissions. Authenticated attackers with contributor-level access or higher can exploit this to read arbitrary posts, including private and draft static blocks or other post types created by administrators, by embedding the [static block content id="X"] shortcode in their own content and previewing it.

Recommendations Update to a version later than 2.2. As a temporary workaround, restrict the ability of users with contributor-level access to use shortcodes in their content.