Private-taxonomy term metadata disclosure through block bindings

Summary

Block bindings can expose term metadata from a taxonomy that is not publicly queryable or REST-visible when the bound term-data source is rendered.

Affected Products

WordPress core 7.0.4; block bindings term-data source.

Affected Scope

Product

WordPress

Component

Block Bindings term-data source

Affected function

wp-includes/block-bindings/term-data.php; term-data source; taxonomy and term_id inputs

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-200; CWE-862

Technical Summary

The binding source resolves term metadata based on the bound object but does not consistently enforce the taxonomy’s public visibility flags before output.

Prerequisites and Permissions

A rendered block with a term-data binding and a private/non-REST taxonomy; viewer access to that rendered content is required.

Affected Locations

wp-includes/block-bindings/term-data.php; taxonomy, term_id and bound field/value parameters; block rendering path.

Reproducible Proof

A controlled private taxonomy term description appeared in the rendered bound field while direct public taxonomy/REST queries were unavailable.

Vulnerable Code

$term_id  = $block_instance->context[&class="tok-comment">#39;termId'] ?? null;
$taxonomy = $block_instance->context[&class="tok-comment">#39;taxonomyclass="tok-string">'] ?? '';
if ( empty( $term_id ) || empty( $taxonomy ) ) {
	return null;
}
$term = get_term( $term_id, $taxonomy );
if ( is_wp_error( $term ) || ! $term ) {
	return null;
}

Severity

low

Technical Analysis

The term-data binding resolves taxonomy/term values for block rendering without consistently reapplying the taxonomy’s public-query and REST visibility boundary. A bound field can therefore serialize a private term name/description into rendered output.

Impact

Confidentiality impact: disclosure of private taxonomy term metadata to a viewer of the affected rendered block. No term mutation or arbitrary code execution is claimed.

Remediation

Require public visibility or an explicit capability before resolving term-data bindings, and add tests for publicly_queryable=false/show_in_rest=false taxonomies.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.