CVE-2026-86783
Medium
Description
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.
SeverityMedium
CVSS5.3
Exploit probability—
ProductPost Grid Gutenberg Blocks
PublishedSep 23, 2026
First seenSep 23, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- Post Grid Gutenberg Blocks5.0.41 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Post Grid Gutenberg Blocks | v < 5.0.41 | 5.0.41 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.