CVE-2026-75017
MediumCVSS 4.3Summary
The Magazine Blocks plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6 due to improper verification that a user is authorized to perform an action. An authenticated attacker with contributor-level access and above can demote administrator-owned published builder templates to draft status and replace them with attacker-authored block content rendered site-wide.
Risk Assessment
This enables defacement, phishing, and SEO spam, potentially damaging the organization's reputation and security.
Recommendation
Update the Magazine Blocks plugin to a version later than 1.8.6 and restrict Contributor-level permissions.
Other vulnerabilities in Magazine Blocks
See all- CVE-2026-75016Medium
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr().
- CVE-2026-78290Medium
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Original NVD description (English source)
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.