CVE-2024-13635: 
WordPress vulnerability analysis and mitigation

The VK Blocks plugin for WordPress (CVE-2024-13635) contains a Sensitive Information Exposure vulnerability affecting all versions up to and including 1.94.2.2. The vulnerability was discovered by researcher Nishiv and was published on March 6, 2025. The issue specifically affects the page content block functionality of the plugin (NVD, Wordfence Weekly).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness is categorized as CWE-284 (Improper Access Control). The vulnerability exists in the page content block component of the plugin, which fails to properly restrict access to sensitive content (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to extract sensitive data, including the content of private posts and pages that they should not have access to (NVD).

Users should update their VK Blocks plugin to a version newer than 1.94.2.2 to address this vulnerability. The fix has been implemented in the plugin's repository (WordPress Plugin).