CVE-2026-40728
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Missing Authorization vulnerability in BlockArt Magazine Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Magazine Blocks through version 1.8.3.
Risk Assessment
An attacker could access functions or data they are not authorized for, potentially leading to unauthorized changes.
Recommendation
Update the Magazine Blocks plugin to a version later than 1.8.3.
Other vulnerabilities in Magazine Blocks
See all- CVE-2026-75017Medium
The Magazine Blocks plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6 due to improper verification that a user is authorized to perform an action. An authenticated attacker with contributor-level access and above can demote administrator-owned published builder templates to draft status and replace them with attacker-authored block content rendered site-wide.
- CVE-2026-75016Medium
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr().
- CVE-2026-78290Medium
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Original NVD description (English source)
Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Blocks: from n/a through <= 1.8.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS