PT-2026-34842 · WordPress · Maxiblocks Builder

Teerachai Somprasong · Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-2028

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MaxiBlocks Builder versions prior to 2.1.9

Description Insufficient file ownership validation in the 'maxi remove custom image size' AJAX action allows authenticated attackers with Author-level access or higher to delete arbitrary media files within the wp-content/uploads directory. This includes files uploaded by other users and administrators.

Recommendations Update to a version newer than 2.1.8.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-2028

Affected Products

Maxiblocks Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2028 · Security Note
• https://github.com/maxi-blocks/maxi-blocks/commit/3dff1db57bfb4e6c14fa7fd42037178d1d0ce199 · Note
• https://plugins.trac.wordpress.org/browser/maxi-blocks/trunk/core/class-maxi-image-crop.php#L44 · Note
• https://plugins.trac.wordpress.org/changeset/3476709/maxi-blocks/trunk/core/class-maxi-image-crop.php · Note
• https://twitter.com/CVEnew/status/2048099319530627483 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f50c31df-56d0-4c34-a93c-56198fe91b36?source=cve · Note
• https://plugins.trac.wordpress.org/browser/maxi-blocks/tags/2.1.7/core/class-maxi-image-crop.php#L44 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3476709%40maxi-blocks&new=3476709%40maxi-blocks&sfp_email=&sfph_mail= · Note