CVE-2026-6675
Unauthenticated Open Email Relay in Responsive Blocks Plugin
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| responsive_blocks | page_builder_for_blocks_and_patterns | to 2.2.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress, affecting all versions up to and including 2.2.0.
It is an Unauthenticated Open Email Relay issue caused by insufficient authorization checks and missing server-side validation of the recipient email address supplied via a public REST API route.
This allows unauthenticated attackers to send arbitrary emails to any recipient through the affected WordPress site's mail server, effectively turning the site into an open mail relay.
How can this vulnerability impact me? :
This vulnerability can be exploited by attackers to send arbitrary emails through your WordPress site's mail server without authentication.
As a result, your site could be used to send spam or malicious emails, potentially damaging your domain's reputation and leading to blacklisting by email providers.
It may also increase the risk of your server being involved in phishing or other email-based attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to use the affected WordPress site as an open mail relay to send arbitrary emails. This could potentially lead to misuse of the site’s mail server for spam or phishing attacks.
However, there is no specific information provided about direct impacts on compliance with common standards and regulations such as GDPR or HIPAA.