{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1560", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-28T19:28:12.274Z", "datePublished": "2026-02-11T08:26:27.556Z", "dateUpdated": "2026-04-08T17:16:14.897Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:14.897Z"}, "affected": [{"vendor": "nko", "product": "Custom Block Builder \u2013 Lazy Blocks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Custom Block Builder \u2013 Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server."}], "title": "Custom Block Builder \u2013 Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1853c88-277b-4955-b042-aeed1cffb49b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-rest.php#L88"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L1637"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L766"}, {"url": "https://plugins.trac.wordpress.org/changeset/3454012/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "timeline": [{"time": "2026-01-29T00:40:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:40:33.786012Z", "id": "CVE-2026-1560", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:44:32.463Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1560", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T15:40:33.786012Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:40:34.510Z"}}], "cna": {"title": "Custom Block Builder \u2013 Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution", "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "nko", "product": "Custom Block Builder \u2013 Lazy Blocks", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-29T00:40:11.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-10T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1853c88-277b-4955-b042-aeed1cffb49b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-rest.php#L88"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L1637"}, {"url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L766"}, {"url": "https://plugins.trac.wordpress.org/changeset/3454012/"}], "descriptions": [{"lang": "en", "value": "The Custom Block Builder \u2013 Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-11T08:26:27.556Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1560", "state": "PUBLISHED", "dateUpdated": "2026-02-11T15:44:32.463Z", "dateReserved": "2026-01-28T19:28:12.274Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-11T08:26:27.556Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Custom Block Builder \u2013 Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server."}, {"lang": "es", "value": "El plugin Custom Block Builder \u2013 Lazy Blocks para WordPress es vulnerable a la ejecuci\u00f3n remota de c\u00f3digo en todas las versiones hasta la 4.2.0, inclusive, a trav\u00e9s de m\u00faltiples funciones en la clase 'LazyBlocks_Blocks'. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, ejecuten c\u00f3digo en el servidor."}], "id": "CVE-2026-1560", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-11T09:15:51.353", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L1637"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-blocks.php#L766"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lazy-blocks/trunk/classes/class-rest.php#L88"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3454012/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1853c88-277b-4955-b042-aeed1cffb49b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.0]"}}], "product": "custom_block_builder_\u2013_lazy_blocks", "vendor": "nko"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:18:43.780242+00:00", "value": {"mitigation_remediation": ["Upgrade the Custom Block Builder \u2013 Lazy Blocks plugin to version 4.2.1 or later. ", "Remove any malicious code or customizations added after the vulnerability was disclosed. ", "Restrict Contributor and higher roles to only the permissions necessary for their tasks, or consider disabling or limiting role elevation for untrusted users."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Custom Block Builder \u2013 Lazy Blocks plugin in any version up to and including 4.2.0 are affected. Users should verify the installed plugin version and determine if it falls within the vulnerable range.", "description_and_impact": "The Custom Block Builder \u2013 Lazy Blocks plugin for WordPress is vulnerable to remote code execution within the \u2018LazyBlocks_Blocks\u2019 class. The flaw allows an authenticated user with Contributor-level permissions or higher to execute arbitrary code on the server. This results in full compromise of the installation, permitting attackers to gain any privileges the site\u2019s user accounts possess, leading to possible data theft, site defacement, or further lateral movement.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, indicating a high severity consequence. The EPSS score is currently below 1%, which suggests a low probability of active exploitation at this time. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. The attack vector requires authenticated access; therefore, an attacker must first obtain Contributor or higher level privileges on the target WordPress site to exploit the flaw. Once authenticated, the attacker can trigger the vulnerable functions and execute arbitrary code on the server."}}}}, "created": "2026-02-11T21:45:59.585753+00:00", "updated": "2026-04-15T17:30:10.486011+00:00", "vendors": ["nko", "nko$PRODUCT$custom_block_builder_\u2013_lazy_blocks", "wordpress", "wordpress$PRODUCT$wordpress"]}