The GenerateBlocks WordPress plugin up to version 2.2.0 contains an Insecure Direct Object Reference (IDOR) vulnerability in its REST API endpoint /wp-json/generateblocks/v1/dynamic-tag-replacements. This flaw allows authenticated users with Contributor-level or higher permissions to access sensitive information from arbitrary posts by exploiting insufficient authorization checks on post-specific data. Attackers can extract data such as author email addresses and non-protected post meta values by crafting malicious dynamic tag payloads.