PT-2026-7490 · WordPress · Custom Block Builder – Lazy Blocks

Youssef Elouaer · Publicado 2026-02-11 · Atualizado 2026-02-16 · CVE-2026-1560

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Custom Block Builder – Lazy Blocks versions prior to 4.2.1

Description The Custom Block Builder – Lazy Blocks plugin for WordPress has a flaw that allows for Remote Code Execution. An authenticated attacker with Contributor-level access or higher can execute code on the server through multiple functions within the LazyBlocks Blocks class.

Recommendations Update the Custom Block Builder – Lazy Blocks plugin to version 4.2.1 or later.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-1560

Produtos afetados

Custom Block Builder – Lazy Blocks

Referências · 11

• https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L766 · Nota
• https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-rest.php#L88 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b1853c88-277b-4955-b042-aeed1cffb49b?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3454012 · Nota
• https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L1637 · Nota
• https://twitter.com/cracbot/status/2023351721439957264 · Publicação no Twitter
• https://t.me/CVEtracker/44393 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2021426747216986266 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2021587877226815693 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2021524548856991849 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1560 · Nota de Segurança