The Cozy Blocks plugin does not properly verify user authorization when rendering certain blocks. As a result, unauthenticated visitors can supply the "wishlistData" parameter and obtain the nonce that normally protects the data handler. The lack of authorization allows those visitors to retrieve complete details—including name, price, short description, image URL, permalink, stock status, and product type—of WooCommerce products that are draft, pending, private, or catalog‑hidden, which would normally be hidden from public view.

This flaw impacts the Cozy Themes Cozy Blocks – Page Builder for Gutenberg Editor & FSE plugin for WordPress. All releases up to and including version 2.2.17 are affected; later releases are presumed to have an updated code path that performs proper authorization checks.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. The vector is likely feasible: an attacker only needs to craft a request to a publicly accessible page that renders the affected block and include the parameter to trigger the handler. The absence of any authentication prerequisite leads to a low barrier to exploitation and a moderate impact on confidentiality. The attack can be mitigated by upstream patching or by temporarily blocking access to the block rendering routes.