The Meta Field Block plugin for WordPress allows authenticated users to specify arbitrary object IDs and types through block attributes. Because the plugin fails to verify that the user has permission to access the requested object's metadata, a user with Contributor or higher privileges can read meta data of any user, post, or term. This can expose sensitive PII, such as names and addresses, that are stored in meta fields by other plugins (e.g., WooCommerce).

Any WordPress site running Meta Field Block version 1.5.1 or earlier is vulnerable. Sites that allow contributors to edit or insert Gutenberg blocks and have active Meta Field Block should consider themselves at risk. The flaw is limited to authenticated users; unauthenticated users cannot exploit it.

The vulnerability carries a CVSS v3.1 score of 6.5, indicating moderate severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, so there is no public evidence of exploitation yet. Successful exploitation requires login with at least Contributor access and ability to edit blocks. Once these prerequisites are met, the attack is trivial by adding or editing a block that references the vulnerable attribute. The resulting privilege escalation permits arbitrary reading of meta data, which constitutes a moderate threat to confidentiality.