The Gutenberg Essential Blocks plugin allows any external user to call a public REST endpoint that accepts a custom post type name. The plugin does not verify that the supplied post type is publicly viewable before executing the query, so an attacker can read entries that the site has marked as non‑public. This flaw exposes confidential information that should be hidden from unauthenticated users and can degrade the confidentiality of a site’s content.

WordPress installations that use the Gutenberg Essential Blocks plugin with a version older than 6.4.0 are directly affected. Any site that registers custom post types as non‑public and activates the plugin is at risk, regardless of other security measures in place. The vendor is currently recorded as Unknown; the product name remains Gutenberg Essential Blocks.

No CVSS score is reported for this vulnerability, and the EPSS score is unavailable. It is not listed in the CISA Known Exploited Vulnerability catalog. The attack vector is straightforward: an unauthenticated user can request the vulnerable endpoint from any location that can reach the site’s REST API, and the plugin will return the requested content. Because no authentication is required and the flaw is simply a missing check, exploitation is likely to succeed on any affected instance. The lack of public exploitation data suggests this may still be in the discovery phase, but the simplicity of the attack path and the potential impact warrant prompt attention.