CVE-2026-2371 is an insecure direct object reference vulnerability (CWE-862) in the Greenshift – animation and page builder blocks WordPress plugin. The issue arises because the AJAX handler `gspb_el_reusable_load()` does not perform authorization checks such as `current_user_can('read_post', $post_id)` or validate the post status before rendering the content of `wp_block` posts. Additionally, the AJAX nonce is exposed to unauthenticated users on public pages using the `[wp_reusable_render]` shortcode with `ajax="1"`. This combination allows unauthenticated attackers to access the rendered HTML of private, draft, or password-protected reusable blocks, potentially exposing sensitive content.

An unauthenticated attacker can retrieve the rendered HTML content of private, draft, or password-protected reusable blocks within WordPress sites using the affected plugin. This leads to unauthorized disclosure of potentially sensitive information. The vulnerability does not allow modification or deletion of content, nor does it impact availability. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the confidentiality impact without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, consider disabling the affected AJAX handler or removing the `[wp_reusable_render]` shortcode with `ajax="1"` from public pages to prevent exposure of the nonce and unauthorized content retrieval.