The aBlocks plugin for WordPress contains a flaw in the ablocks_template shortcode that allows an authenticated user with contributor level or higher to supply an arbitrary post ID via the 'id' parameter. When the shortcode is rendered the plugin returns the complete rendered body content of the requested post even if that post is password‑protected, thereby leaking sensitive information. An author or higher can take this further by publishing a post that embeds the shortcode, making the protected content visible to all visitors.

Any WordPress site running aBlocks version 2.18.0 or earlier is affected. Users who can create or edit content at contributor level or above can trigger the information exposure. The vulnerability exists regardless of the particular post type.

The CVSS score of 4.3 indicates a low to moderate severity, and the EPSS score is not available, so the likelihood of exploitation is currently unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a contributor‑level authenticated session, so the attack vector is internal; an attacker must already have access to the site’s content management role. Because the exposed data is the full body of password‑protected content, sensitive post details—including private text, embedded media, or proprietary information—could be harvested. The impact is primarily confidentiality breach and potential reputational harm if the leaked content is publicly visible.