The GenerateBlocks plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to and including 1.9.1. Authenticated users with Contributor-level privileges or above can exploit the 'get_image_description' function to retrieve content from private, draft, and scheduled posts and pages, which should normally be inaccessible. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact primarily on confidentiality. There is no indication of known exploits in the wild, and no patch or official remediation has been provided as of the published date.

An attacker with Contributor-level or higher access can extract sensitive content from private, draft, and scheduled posts and pages, leading to unauthorized disclosure of confidential information. The vulnerability does not impact data integrity or system availability. Since the exposure requires authenticated access, the risk is limited to users who already have some level of access to the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only. Monitor for updates from the GenerateBlocks plugin vendor and apply any forthcoming patches promptly.