The Greenshift – animation and page builder blocks plugin for WordPress contains an insecure direct object reference flaw in the gspb_el_reusable_load AJAX handler. The handler accepts an arbitrary post_id parameter and renders the content of any wp_block post without verifying that the current user has permission to read the post or that the post is public. Consequently, unauthenticated attackers can retrieve the rendered HTML of private, draft, or password‑protected reusable blocks, exposing confidential content. This vulnerability is classified as CWE‑862 (Missing Authorization).

All installations of the Greenshift – animation and page builder blocks plugin for WordPress up to and including version 12.8.3 are affected. Users running these or earlier versions of the plugin on any WordPress site can be compromised.

The CVSS score is 5.3, indicating medium severity, while the EPSS score is below 1%, implying a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated request to the gspb_el_reusable_load AJAX endpoint, where the attacker can supply any post_id and obtain the rendered block content. Because the nonce is exposed on publicly accessible pages that use the wp_reusable_render shortcode with ajax="1", the attack does not require user authentication or elevated privileges, making this an exploitable unauthorized disclosure scenario.