CVE-2026-86783: PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.
Affected Software
Event History
Frequently Asked Questions
Which posts can have their custom field key names exposed?
Unauthenticated users can retrieve custom field key names for arbitrary posts, including private, draft, pending, scheduled, and password-protected posts.
Does an attacker need a WordPress account or access to the affected post?
No. The affected REST API route lacks authorization and post-visibility checks, so an unauthenticated user can disclose the field key names.
What information is disclosed?
The issue exposes custom field key names, not necessarily the values stored in those fields. However, key names may reveal implementation details or identify potentially sensitive metadata fields.