CVE-2026-75017 Details
Description
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.
A vulnerability exists in the Magazine Blocks WordPress plugin, specifically in versions through 1.8.6. The issue stems from an authorization bypass that allows authenticated users with contributor-level access and above to manipulate published builder templates owned by administrators. Exploiting this vulnerability involves demoting these templates to draft status and replacing them with custom block content created by the attacker, which is then displayed site-wide. This could lead to defacement, phishing attempts, and SEO spam. The vulnerability arises because the 'mzb-builder-template' post type, which is accessible via the REST API, does not have proper authorization checks. Additionally, the '_mzb_template' meta key can be accessed by any user with the capability to edit posts, enabling contributors to trigger the vulnerable 'save_post()' hook.
Users are advised to update the Magazine Blocks WordPress plugin to version 1.8.7 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WPBlockArt Magazine Blocks | <= 1.8.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |