Unauthenticated PHP Code Execution in Custom Block Builder WordPress Plugin

Executive Summary

This vulnerability is an unauthenticated Remote Code Execution (RCE) flaw in the Custom Block Builder WordPress plugin versions before 3.0.0. The plugin fails to properly deny unauthorized requests to its REST routes, returning non-error responses that WordPress treats as permission granted. This allows unauthenticated users to execute arbitrary PHP code on the server.

Useful 0 Not Useful 0

Detection Guidance

Check if the Lazy Blocks plugin version is below 3.0.0 by inspecting the WordPress admin panel or running the command: wp plugin list | grep lazy-blocks. If vulnerable, unauthenticated users may execute arbitrary PHP code via REST routes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious code on your server, potentially taking full control of your website, stealing data, installing malware, or using your server for further attacks. Since no authentication is required, any visitor could trigger this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Lazy Blocks plugin to version 3.0.0 or later immediately. If updating is not possible, disable the plugin temporarily until an update is applied to prevent unauthenticated RCE.

Useful 0 Not Useful 0