CVE-2026-3454 describes an insecure direct object reference vulnerability in the GenerateBlocks WordPress plugin (up to version 2.2.0). The REST endpoint /wp-json/generateblocks/v1/dynamic-tag-replacements performs insufficient authorization checks by validating only the edit_posts capability but not verifying if the user has permission to access the specific post or its associated data identified by attacker-controlled id parameters. This allows authenticated users with Contributor-level permissions or higher to extract sensitive information from arbitrary posts by crafting dynamic tag payloads referencing post meta or author email fields.

An attacker with Contributor-level or higher privileges can bypass object-level authorization controls to access sensitive information from arbitrary posts, including author email addresses and non-protected post meta data. This leads to confidentiality breaches but does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict Contributor-level user permissions if possible and monitor for suspicious use of the dynamic-tag-replacements REST endpoint. Avoid exposing sensitive post meta data via dynamic tags. Follow vendor updates closely for an official fix.