CVE-2026-24377: 
WordPress vulnerability analysis and mitigation

CVE-2026-24377 is a Sensitive Data Exposure vulnerability in the POSIMYTH Nexter Blocks WordPress plugin (also known as the-plus-addons-for-block-editor). It allows authenticated attackers with at least Subscriber-level privileges to retrieve embedded sensitive system information that should not be accessible to regular users. The vulnerability affects all versions of Nexter Blocks up to and including 4.6.3, with version 4.6.4 containing the fix. It was published on January 22, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), mapped to CAPEC-170 (Web Application Fingerprinting). The flaw enables an authenticated user with low privileges (Subscriber role or equivalent) to access sensitive system information embedded within the plugin that is not intended for general users. Exploitation requires network access, low attack complexity, and no user interaction, but does require authentication. No public technical write-up or proof-of-concept code has been identified beyond the Patchstack advisory (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to view sensitive system information that is normally restricted, which could be leveraged to identify further weaknesses or attack vectors within the WordPress installation. The impact is limited to confidentiality (low), with no integrity or availability impact. While the direct damage is limited, the exposed information could facilitate more targeted follow-on attacks against the affected WordPress site (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-24377. The EPSS score is very low at approximately 0.018%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites, this specific issue is assessed as low priority and unlikely to be exploited (Patchstack).

The vendor POSIMYTH Innovations released version 4.6.4 of the Nexter Blocks plugin to address this vulnerability. Site administrators should update the plugin to version 4.6.4 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Subscriber-level user registration or access to the WordPress site can reduce exposure (Patchstack).

The vulnerability was discovered and reported by security researcher Nabil Irawan on December 27, 2025, and published by Patchstack on January 26, 2026. Community reaction has been minimal given the low severity rating, with automated aggregators such as Vulners, CVEFeed, and VulDB picking up the disclosure. No notable vendor statements or significant media coverage beyond the Patchstack advisory have been identified (Patchstack).