CVE-2026-10780 describes an Insecure Direct Object Reference vulnerability (CWE-639) in the Static Block plugin for WordPress. The static_block_content() shortcode handler uses an attacker-supplied 'id' attribute to fetch posts via get_post() and outputs their content without verifying the post's status or the requesting user's permissions. This allows authenticated users with contributor-level privileges or above to view private, draft, or pending posts, including administrator-created static blocks, by embedding the shortcode with arbitrary post IDs in their content and previewing it.

An attacker with contributor-level access or higher can bypass authorization controls to read the content of arbitrary posts, including private and draft posts that should be restricted. This leads to unauthorized disclosure of potentially sensitive information contained in static blocks or other post types.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access carefully and avoid using the vulnerable shortcode with untrusted input. Monitor official sources for updates or patches addressing this vulnerability.