PT-2026-49611 · Mohammadtanzilurrahman · Static Block

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-10780

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static block content() shortcode handler retrieving a post via get post() using an attacker-supplied 'id' attribute and outputting its post content without verifying the post's status (private, draft, pending) or the requesting user's capability to view it. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary posts, including private and draft static blocks (and any other post type) created by administrators, by embedding the [static block content id="X"] shortcode in their own content and previewing it.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-10780

Affected Products

Static Block

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-10780 · Security Note
• https://plugins.trac.wordpress.org/browser/static-block/trunk/static-block.php#L270 · Note
• https://plugins.trac.wordpress.org/browser/static-block/trunk/static-block.php#L244 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f88c00ca-cf9e-44e7-9495-686ace1ead21?source=cve · Note
• https://plugins.trac.wordpress.org/browser/static-block/trunk/static-block.php#L268 · Note