The VK Blocks plugin for WordPress suffers from an improper access control vulnerability (CWE-284) that enables authenticated users with Contributor-level privileges or above to extract sensitive data, including private post and page content, via the page content block. This vulnerability affects all versions up to 1.94.2.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and limited privileges required. No known exploits are reported in the wild, and no patch or remediation details have been provided.

An attacker with Contributor-level access or higher can exploit this vulnerability to access sensitive information that should be restricted, such as the content of private posts and pages. This exposure could lead to unauthorized disclosure of confidential data within the WordPress site. The vulnerability does not impact integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for any unusual access patterns. Avoid granting Contributor or higher privileges to untrusted users.