GenerateBlocks <= 2.2.0 — Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under GenerateBlocks.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 2.2.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch GenerateBlocks to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to kai63001.

The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint only verifies that the user has the edit_posts capability but does not verify the user has permission to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information from arbitrary posts including author email addresses and non-protected post meta values by crafting dynamic tag payloads such as {{post_meta id:<target>|key:<meta_key>}} and {{post_title id:<target>|link:author_email}}.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. May 4, 2026

   CVE published

   Severity medium, CVSS 6.5

2. Nov 13, 2026

   Record last updated