CVE-2026-2371

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2371", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-11T20:40:34.454Z", "datePublished": "2026-03-06T23:22:58.749Z", "dateUpdated": "2026-04-08T16:52:48.813Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:48.813Z"}, "affected": [{"vendor": "wpsoul", "product": "Greenshift \u2013 animation and page builder blocks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "12.8.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 12.8.3. This is due to missing authorization and post status validation in the `gspb_el_reusable_load()` AJAX handler. The handler accepts an arbitrary `post_id` parameter and renders the content of any `wp_block` post without checking `current_user_can('read_post', $post_id)` or verifying the post status. Combined with the nonce being exposed to unauthenticated users on any public page using the `[wp_reusable_render]` shortcode with `ajax=\"1\"`, this makes it possible for unauthenticated attackers to retrieve the rendered HTML content of private, draft, or password-protected reusable blocks."}], "title": "Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52632b50-9755-4ebd-a1a8-587cc633debb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1674"}, {"url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1630"}, {"url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/settings.php#L1674"}, {"url": "https://plugins.trac.wordpress.org/changeset/3465111/greenshift-animation-and-page-builder-blocks/trunk/settings.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}], "timeline": [{"time": "2026-02-11T20:55:45.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-06T11:20:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T19:12:44.888443Z", "id": "CVE-2026-2371", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:34:32.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T19:12:44.888443Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:12:46.038Z"}}], "cna": {"title": "Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'", "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "wpsoul", "product": "Greenshift \u2013 animation and page builder blocks", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.8.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-11T20:55:45.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-06T11:20:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52632b50-9755-4ebd-a1a8-587cc633debb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1674"}, {"url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1630"}, {"url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/settings.php#L1674"}, {"url": "https://plugins.trac.wordpress.org/changeset/3465111/greenshift-animation-and-page-builder-blocks/trunk/settings.php"}], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 12.8.3. This is due to missing authorization and post status validation in the `gspb_el_reusable_load()` AJAX handler. The handler accepts an arbitrary `post_id` parameter and renders the content of any `wp_block` post without checking `current_user_can('read_post', $post_id)` or verifying the post status. Combined with the nonce being exposed to unauthenticated users on any public page using the `[wp_reusable_render]` shortcode with `ajax=\"1\"`, this makes it possible for unauthenticated attackers to retrieve the rendered HTML content of private, draft, or password-protected reusable blocks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:48.813Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2371", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:48.813Z", "dateReserved": "2026-02-11T20:40:34.454Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-06T23:22:58.749Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Greenshift \u2013 animation and page builder blocks", "vendor": "wpsoul", "versions": [{"lessThanOrEqual": "12.8.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 12.8.3. This is due to missing authorization and post status validation in the `gspb_el_reusable_load()` AJAX handler. The handler accepts an arbitrary `post_id` parameter and renders the content of any `wp_block` post without checking `current_user_can('read_post', $post_id)` or verifying the post status. Combined with the nonce being exposed to unauthenticated users on any public page using the `[wp_reusable_render]` shortcode with `ajax=\"1\"`, this makes it possible for unauthenticated attackers to retrieve the rendered HTML content of private, draft, or password-protected reusable blocks."}, {"lang": "es", "value": "El plugin Greenshift \u2013 bloques de animaci\u00f3n y constructor de p\u00e1ginas para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 12.8.3, inclusive. Esto se debe a la falta de autorizaci\u00f3n y validaci\u00f3n del estado de la publicaci\u00f3n en el gestor AJAX 'gspb_el_reusable_load()'. El gestor acepta un par\u00e1metro 'post_id' arbitrario y renderiza el contenido de cualquier publicaci\u00f3n 'wp_block' sin verificar 'current_user_can('read_post', $post_id)' o el estado de la publicaci\u00f3n. Combinado con que el nonce se expone a usuarios no autenticados en cualquier p\u00e1gina p\u00fablica que utilice el shortcode '[wp_reusable_render]' con 'ajax=\"1\"', esto hace posible que atacantes no autenticados recuperen el contenido HTML renderizado de bloques reutilizables privados, en borrador o protegidos con contrase\u00f1a."}], "id": "CVE-2026-2371", "lastModified": "2026-06-17T10:30:51.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2371", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T19:12:44.888443Z", "version": "2.0.3"}}]}, "published": "2026-03-07T00:16:13.457", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1630"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1674"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/settings.php#L1674"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3465111/greenshift-animation-and-page-builder-blocks/trunk/settings.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/52632b50-9755-4ebd-a1a8-587cc633debb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.8.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Greenshift \u2013 animation and page builder blocks", "source": "cna", "vendor": "wpsoul"}, "product": "greenshift_\u2013_animation_and_page_builder_blocks", "vendor": "wpsoul"}], "analysis": {"en": {"generated_at": "2026-04-15T17:50:57.437675+00:00", "value": {"mitigation_remediation": ["Update the Greenshift plugin to a version that includes the missing authorization check, such as 12.8.4 or later.", "If an immediate update is not possible, restrict access to the gspb_el_reusable_load AJAX endpoint by ensuring only authenticated users can call it, for example by adding a permission check before processing the request.", "Remove or sanitize the wp_reusable_render shortcode with ajax=\"1\" from all publicly accessible pages to prevent pose exposure of the nonce and the unauthenticated AJAX entry point."], "summary": {"action": "Apply Patch", "impact": "Unauthorized disclosure of private reusable block content"}, "threat_synthesis": {"affected_systems": "All installations of the Greenshift \u2013 animation and page builder blocks plugin for WordPress up to and including version 12.8.3 are affected. Users running these or earlier versions of the plugin on any WordPress site can be compromised.", "description_and_impact": "The Greenshift \u2013 animation and page builder blocks plugin for WordPress contains an insecure direct object reference flaw in the gspb_el_reusable_load AJAX handler. The handler accepts an arbitrary post_id parameter and renders the content of any wp_block post without verifying that the current user has permission to read the post or that the post is public. Consequently, unauthenticated attackers can retrieve the rendered HTML of private, draft, or password\u2011protected reusable blocks, exposing confidential content. This vulnerability is classified as CWE\u2011862 (Missing Authorization).", "risk_and_exploitability": "The CVSS score is 5.3, indicating medium severity, while the EPSS score is below 1%, implying a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated request to the gspb_el_reusable_load AJAX endpoint, where the attacker can supply any post_id and obtain the rendered block content. Because the nonce is exposed on publicly accessible pages that use the wp_reusable_render shortcode with ajax=\"1\", the attack does not require user authentication or elevated privileges, making this an exploitable unauthorized disclosure scenario."}}}}, "created": "2026-03-09T10:06:15.415393+00:00", "updated": "2026-04-15T18:00:15.476878+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpsoul", "wpsoul$PRODUCT$greenshift_\u2013_animation_and_page_builder_blocks"]}