CVE-2026-13153

HighCVSS 7.5/10Last modified Aug 26, 2026

Description

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Gutenberg Essential Blocks	< 6.4.0

References

https://wpscan.com/vulnerability/0401a229-9630-49ab-ae4b-53360cf5d109/

Timeline

Published: Aug 6, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-131547.5The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable befor CVE-2026-131565.4The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_opti CVE-2026-131577.2The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-CVE-2026-131587.2The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress fi CVE-2026-131594.3The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authe CVE-2026-13167.2The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].href' parameter in a CVE-2026-131617.5The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[trueb CVE-2026-131627.7An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system command CVE-2026-131635.3Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all CVE-2026-131648.8Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/views.py), exposed at POST /api/auth/register/, in CVE-2026-131658.6SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native librar CVE-2026-131674.3The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorizati