Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint only verifies that the user has the edit_posts capability but does not verify the user has permission to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information from arbitrary posts including author email addresses and non-protected post meta values by crafting dynamic tag payloads such as {{post_meta id:<target>|key:<meta_key>}} and {{post_title id:<target>|link:author_email}}.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-05 | 2 | Disclosure2 |
| 2026-05-06 | 1 | Patch1 |
CVE-2026-3454 The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-lev… https://www.cve.org/CVERecord?id=CVE-2026-3454
Post summary
This post announces that the GenerateBlocks WordPress plugin up to v2.2.0 is vulnerable to an Insecure Direct Object Reference, but provides no PoC, exploit, or patch information.
@CVEnew Good find. CVE-2026-3454 highlights why object-level authorization matters in popular plugins like GenerateBlocks. Contributors could pull sensitive post data before the 2.2.1 fix.
Post summary
The tweet spotlights CVE‑2026‑3454, an object‑level authorization flaw in GenerateBlocks that could expose sensitive post data before the 2.2.1 update, and indicates a patch is available.
🚨*CVE* CVE-2026-3454 The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-lev… https://www.cve.org/CVERecord?id=CVE-2026-3454 ----- Traducción: CVE-2026-3454 El … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑3454, an IDOR vulnerability in the GenerateBlocks WordPress plugin through version 2.2.0, and provides a link to the official CVE record.