Detections
Analytics
CVE-2026-13153
high
Description
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.
References
https://wpscan.com/vulnerability/0401a229-9630-49ab-ae4b-53360cf5d109/