{
 "id": "WPSEC-2026-2792",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2792/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2792/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2792/index.md",
 "title": "ZoloBlocks <= 2.8.2 - Unauthenticated Sensitive Information Exposure via 'zolo/v1/posts' REST Endpoint",
 "description": "The ZoloBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'zolo/v1/posts' REST endpoint in all versions up to, and including, 2.8.2, due to the post query builder accepting an arbitrary, user-supplied post type (the 'postType' and 'currentPostType' query parameters) without restricting it to publicly viewable post types, while the endpoint's permission callback always returns true and its nonce is exposed to every visitor. This makes it possible for unauthenticated attackers to read the titles and contents of published records of non-public post types stored by other plugins, such as Flamingo inbound form messages or WooCommerce coupons.",
 "plugin": {
  "slug": "zoloblocks",
  "name": "ZoloBlocks",
  "full_name": "ZoloBlocks – Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit",
  "wordpress_org": "https://wordpress.org/plugins/zoloblocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/zoloblocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/zoloblocks"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.4",
 "remediation": "Update to 2.8.4 or later.",
 "fix_released": "2026-11-09T09:58:19+00:00",
 "published": "2026-11-10T10:55:25+00:00",
 "updated": "2026-11-09T23:34:35.965857+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2792/",
  "https://plugins.svn.wordpress.org/zoloblocks/tags/2.8.4/",
  "https://wordpress.org/plugins/zoloblocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/zoloblocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}