CVE-2026-2371 json
Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'
published 2026-03-06 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-10091
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 12.8.3. This is due to missing authorization and post status validation in the `gspb_el_reusable_load()` AJAX handler. The handler accepts an arbitrary `post_id` parameter and renders the content of any `wp_block` post without checking `current_user_can('read_post', $post_id)` or verifying the post status. Combined with the nonce being exposed to unauthenticated users on any public page using the `[wp_reusable_render]` shortcode with `ajax="1"`, this makes it possible for unauthenticated attackers to retrieve the rendered HTML content of private, draft, or password-protected reusable blocks.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- wpsoul Greenshift – animation and page builder blocks
Classification
- Weakness
-
- CWE-862 Missing Authorization
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/52632b50-9755-4ebd-a1a8-587cc633debb?source=cve
- plugins.trac.wordpress.org /browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1674
- plugins.trac.wordpress.org /browser/greenshift-animation-and-page-builder-blocks/tags/12.7.1/settings.php#L1630
- plugins.trac.wordpress.org /browser/greenshift-animation-and-page-builder-blocks/trunk/settings.php#L1674
- plugins.trac.wordpress.org /changeset/3465111/greenshift-animation-and-page-builder-blocks/trunk/settings.php
Sources
- CVE List CVE-2026-2371
- NVD CVE-2026-2371
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.