CVE-2026-13154

A vulnerability exists in Gutenberg Essential Blocks plugin versions prior to 6.4.0, where an attacker can exploit a flaw in how the plugin handles publicly viewable post types through its REST routes, effectively granting unauthorized access to certain published entries of custom post types that are supposed to be private. This occurs because the plugin fails to properly authenticate and authorize requests for these post types before retrieving their data.

Based on public CVE data (MITRE/NVD).