The Gutenberg Essential Blocks WordPress plugin versions prior to 6.4.0 contain an information exposure vulnerability (CWE-200) due to insufficient access control on a public REST API route. This flaw causes the plugin to disclose a non-public WooCommerce metric—the lifetime units sold per product—to unauthenticated users. The vulnerability allows any user, without authentication, to retrieve sales data for published products via the exposed REST endpoint. No CVSS score or detailed exploit information is currently available. There is no vendor advisory or patch information provided at this time.

The vulnerability exposes sensitive sales data (lifetime units sold) for WooCommerce products to unauthenticated users. While this does not directly compromise system integrity or user credentials, it leaks business-sensitive information that could be used for competitive intelligence or other unauthorized analysis. There is no indication of further impact such as code execution or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected REST route or disabling the Gutenberg Essential Blocks plugin if this data exposure is a concern.