The vulnerability resides in the GenerateBlocks WordPress plugin, which registers REST API routes that are protected only by a generic capability check for editing posts. User with Contributor level or higher can request arbitrary user or post meta keys, and the plugin does not verify that the requested data belongs to the caller, nor does it enforce a whitelist of safe keys. Consequently, an attacker can retrieve personally identifiable information such as names, email addresses, phone numbers and addresses from WooCommerce user profiles, enabling phishing, account takeover pretexting, and privacy violations.

Edge22’s GenerateBlocks plugin, versions up to and including 2.1.2, on any WordPress installation. Any site that hosts this plugin and has users with Contributor or higher privileges is exposed.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, underscoring its relative novelty. The likely attack vector is an authenticated user with Contributor or higher role accessing the REST endpoints, which can be exploited without elevated privileges beyond the granted ‘edit_posts’ capability.