PT-2026-7490 · WordPress · Custom Block Builder – Lazy Blocks

Youssef Elouaer · Published 2026-02-11 · Updated 2026-02-16 · CVE-2026-1560

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Custom Block Builder – Lazy Blocks versions prior to 4.2.1

Description The Custom Block Builder – Lazy Blocks plugin for WordPress has a flaw that allows for Remote Code Execution. An authenticated attacker with Contributor-level access or higher can execute code on the server through multiple functions within the LazyBlocks Blocks class.

Recommendations Update the Custom Block Builder – Lazy Blocks plugin to version 4.2.1 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-1560

Affected Products

Custom Block Builder – Lazy Blocks

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-1560 · Security Note
• https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L766 · Note
• https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-rest.php#L88 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b1853c88-277b-4955-b042-aeed1cffb49b?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3454012 · Note
• https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L1637 · Note
• https://twitter.com/cracbot/status/2023351721439957264 · Twitter Post
• https://t.me/CVEtracker/44393 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021426747216986266 · Twitter Post
• https://twitter.com/CveFindCom/status/2021587877226815693 · Twitter Post
• https://twitter.com/TheHackerWire/status/2021524548856991849 · Twitter Post