CVE-2026-15420 in Nexter Blocks Plugin
Summary
by MITRE • 07/24/2026
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary JS/CSS files on the server, which can lead to denial of service or destruction of critical plugin and theme assets.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The Nexter Blocks WordPress plugin presents a critical directory traversal vulnerability that affects all versions up to and including 5.0.0, creating a significant security risk for affected installations. This vulnerability resides in the handling of the 'plus_name' parameter within the plugin's file manipulation functions, allowing authenticated attackers with subscriber-level privileges or higher to exploit the weakness. The flaw enables malicious users to traverse directory structures and access files outside of the intended scope, fundamentally undermining the plugin's security boundaries.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization of user-supplied parameters within the plugin's core functionality. When the 'plus_name' parameter is processed, the system fails to properly validate or sanitize the input before using it in file operations, creating an opportunity for attackers to craft malicious paths that bypass normal access controls. This directory traversal condition allows for arbitrary file deletion operations, specifically targeting javascript and css files that are critical to plugin functionality and website operation.
From an operational perspective, this vulnerability creates multiple attack vectors with severe consequences for affected WordPress installations. An attacker with subscriber-level access can leverage this weakness to delete essential frontend assets, potentially causing complete website breakdowns or denial of service conditions. The impact extends beyond simple disruption as malicious actors could target critical plugin files or theme resources, leading to permanent damage to website functionality and user experience degradation. The vulnerability's accessibility to low-privilege accounts significantly amplifies its threat potential compared to typical file manipulation flaws.
The weakness aligns with CWE-22 Directory Traversal and can be mapped to several ATT&CK techniques including T1059 Command and Scripting Interpreter for executing malicious operations and T1485 Data Destruction for potentially causing system-wide damage. Organizations should implement immediate mitigations including plugin version updates to the latest secure release, implementing strict file access controls, and monitoring for unauthorized file deletion activities. Additionally, administrators should review user permissions and consider implementing additional security layers such as web application firewalls that can detect and block suspicious directory traversal patterns. Regular security audits of WordPress plugins and themes remain essential for identifying similar vulnerabilities that could compromise website integrity and user data protection.