CVE-2026-2371 PUBLISHED

Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'

Assigner: Wordfence
Reserved: 11.02.2026 Published: 06.03.2026 Updated: 06.03.2026

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 12.8.3. This is due to missing authorization and post status validation in the gspb_el_reusable_load() AJAX handler. The handler accepts an arbitrary post_id parameter and renders the content of any wp_block post without checking current_user_can('read_post', $post_id) or verifying the post status. Combined with the nonce being exposed to unauthenticated users on any public page using the [wp_reusable_render] shortcode with ajax="1", this makes it possible for unauthenticated attackers to retrieve the rendered HTML content of private, draft, or password-protected reusable blocks.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor wpsoul
Product Greenshift – animation and page builder blocks
Versions Default: unaffected
  • affected from * to 12.8.3 (incl.)

Credits

  • Lucas Montes finder

References

Problem Types

  • CWE-862 Missing Authorization CWE