The GenerateBlocks plugin contains a missing object‑level authorization check on its dynamic tag replacement REST endpoint. The endpoint verifies only that a user can edit posts but does not confirm that the user has permission to view the specific post or its metadata referenced by attacker‑controlled identifiers. This flaw allows an authenticated user with the Contributor role or higher to read sensitive data such as author email addresses and non‑protected post meta values by crafting dynamic tag payloads like {{post_meta id:<target>|key:<meta_key>}} and {{post_title id:<target>|link:author_email}}.

Any WordPress site that has the GenerateBlocks plugin installed in a version through 2.2.0 will be affected. Sites using newer releases beyond 2.2.0 are not impacted as described. The vulnerability applies to any authenticated user with Contributor or higher capability, regardless of whether they own the target post.

The CVSS score of 6.5 indicates medium severity, and the lack of an EPSS score suggests limited publicly known exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. An attacker must be logged into the site with Contributor‑level access and then perform a REST API call to /wp-json/generateblocks/v1/dynamic-tag-replacements, framing a payload that references another post’s data. Because the endpoint relies only on a generic capability check, the exploit is straightforward for authenticated users and does not require elevated privileges or system compromise.