The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin contains a flaw that allows unauthenticated visitors to read excerpts from password‑protected posts. The vulnerability is triggered by missing checks for post protection when rendering excerpts in the render_excerpt() function and the uagb_get_excerpt() helper. This results in accidental exposure of sensitive content to anyone who can view a page containing a Post Grid, Post Masonry, Post Carousel, or Post Timeline block.

WordPress sites that use the Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin from Brainstormforce, version 2.19.17 or earlier, are affected. The vulnerability exists in all releases up to and including 2.19.17 and impacts any block types that render post excerpts, such as Post Grid, Post Masonry, Post Carousel, or Post Timeline.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of less than 1 % represents a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker only requires the ability to view a page containing the vulnerable blocks; no authentication or privileged access is needed to read the exposed excerpts. The vulnerability exploits a standard information disclosure weakness (CWE‑200) and poses risks to confidentiality for all protected posts displayed in affected blocks.