PT-2026-97181

CVE-2026-86783

Published

2026-09-23

Updated

2026-09-23

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Post Grid Gutenberg Blocks versions prior to 5.0.41

Description An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key names of arbitrary posts, including those that are private, draft, pending, scheduled, or password-protected.

Recommendations Update Post Grid Gutenberg Blocks to version 5.0.41 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pedro Pinho

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers