WordPress Post Grid and Gutenberg Blocks plugin contains an Insecure Direct Object Reference vulnerability that allows an attacker to read content belonging to other users. The flaw arises from improperly controlled access keys and is classified as CWE‑639. The impact includes leakage of private posts or scheduled content, but does not grant code execution or full system compromise.

All installations of PickPlugins Post Grid and Gutenberg Blocks plugin running versions through 2.3.23 are affected. The vulnerability applies to the WordPress plugin regardless of the site’s overall WordPress version.

The CVSS score of 5.3 marks it as a moderate severity issue, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers likely exploit the IDOR via crafted web requests containing the wrong user identifier, potentially without authentication or with minimal privilege. The most common exploitation path uses an HTTP request with altered parameters to access the owner’s content.