CVE-2026-10780: WordPress Static Block Plugin IDOR Vulnerability (Versions ≤2.2)

Technical summary

The vulnerability is an Insecure Direct Object Reference (IDOR) in the static_block_content() shortcode handler. The shortcode accepts a user-supplied 'id' parameter and passes it directly to get_post(), which retrieves the post object. The plugin then outputs the post's content without checking the post's status (private, draft, pending, published) or calling WordPress capability checks like current_user_can(). An authenticated attacker can embed [static_block_content id="X"] into their own draft post and use the preview functionality to retrieve and view post content, since preview rendering does not enforce the same visibility restrictions as public viewing.

Business impact

Organizations using the Static Block plugin on WordPress sites face information disclosure risk. Authenticated contributors can discover sensitive content authors intended to keep private, such as draft announcements, confidential static block content, or administrative notes embedded in unpublished posts. This could lead to premature disclosure of information, competitive intelligence leakage, or exposure of sensitive configuration details if stored in post content.

Affected systems

The Static Block plugin for WordPress is affected in all versions up to and including 2.2. The vulnerability requires authentication (contributor role or higher) to exploit, so it does not affect anonymous visitors. Any WordPress site running this plugin with contributor accounts—whether active or inactive—is at risk if those accounts are compromised or belong to trusted users who become malicious.

Exploitability

Exploitation is straightforward and requires only contributor-level access and the ability to create or edit posts on the WordPress site. An attacker craft a shortcode referencing any post ID, embed it in a draft post, and preview the draft to read the target post's content. No special tools, network access, or complex multi-step exploitation is required. The CVSS score of 4.3 (Medium) reflects that this is a confidentiality issue affecting only authenticated users, with no impact on integrity or availability.

Remediation

Update the Static Block plugin to a version that implements proper capability checks. Verify the patch version against the official WordPress plugin repository or the plugin vendor's security advisory. In the interim, restrict contributor-level access to users who genuinely need it, monitor post creation activity, and consider disabling the static_block_content shortcode if it is not actively used.

Patch guidance

Check the WordPress plugin repository or the plugin's official website for an updated version that addresses this IDOR vulnerability. Apply the update as soon as it is released and tested in a non-production environment. Verify that the updated code calls current_user_can() or equivalent permission checks before outputting post content via the shortcode, and confirms that the post's status permits viewing by the requesting user.

Detection guidance

Monitor WordPress logs and post preview activity for suspicious patterns, such as contributors previewing posts they did not create or posts in draft/private status. If the plugin logs shortcode usage, look for static_block_content shortcodes referencing post IDs that do not correspond to static blocks created by that user. Review post meta tables for revision history or preview requests targeting high-value post IDs (typically lower numbers for administrative or early content). Consider deploying a Web Application Firewall rule to flag or block preview requests containing the static_block_content shortcode from non-authors.

Why prioritize this

Although the CVSS score is Medium (4.3), organizations should prioritize patching based on the sensitivity of draft or private post content on their site. If the site uses the Static Block plugin to store administrative notes, confidential announcements, or sensitive static content, the business impact could be elevated. Conversely, if static blocks contain only non-sensitive boilerplate text, the risk is lower. Assess the actual content stored in private/draft posts before deciding on timeline.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a confidentiality-only vulnerability with low attack complexity, no user interaction required (UI:N), and local scope (S:U). The attack vector is network-based (AV:N) but requires prior authentication (PR:L, contributor privilege required). No integrity or availability impact is possible. The score is not elevated to High because the attack requires legitimate user credentials and does not lead to system compromise or data modification.

Frequently asked questions