The Gutenberg Essential Blocks plugin for WordPress contains missing or incorrect capability checks in three callback functions—get_instagram_access_token_callback, google_map_api_key_save_callback, and get_siteinfo—that allow any authenticated user with Author-level privileges or higher to read API keys that have been configured for external services. This vulnerability enables the disclosure of sensitive credentials, while it does not permit code execution or modification of site content. The weakness is documented as CWE‑862, a missing or incorrect authorization flaw.

WordPress sites that use the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin, specifically any installation running version 5.7.2 or earlier. Versions after 5.7.2 are not impacted by this issue as the patch removes the faulty capability checks.

The CVSS score of 4.3 indicates low severity according to CVSS mapping; the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires that an attacker already holds Author or higher privileges within the WordPress site, so the attack vector is formulated as an in-the-site privilege misuse. While the exposure is limited to API key disclosure, the impact on confidentiality can be significant if the credentials control critical external services.