CVE-2026-3454 Details

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the GenerateBlocks plugin for WordPress, affecting all versions up to and including 2.2.0. The issue arises from the absence of proper object-level authorization checks in the '/wp-json/generateblocks/v1/dynamic-tag-replacements' REST endpoint. While the endpoint verifies that the user has the 'edit_posts' capability, it fails to ensure that the user has permission to access the specific post or its related data referenced by attacker-controlled ID parameters in dynamic tag content. This vulnerability enables authenticated attackers with Contributor-level access or higher to extract sensitive information from arbitrary posts, such as author email addresses and unprotected post meta values. Exploitation can be achieved by crafting dynamic tag payloads that request this information.