CVE-2026-75017 in Magazine Blocks Plugin
Summary
by MITRE • 09/18/2026
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder plugin for WordPress represents a critical authorization bypass affecting all versions up through 1.8.6. This flaw stems from an insufficient verification of user permissions when handling specific administrative actions related to site structure and layout management. Specifically, the issue arises within the post save hook associated with custom post types used by the plugin to manage builder templates such as headers, footers, front pages, single posts, archives, 404 errors, and search results. The root cause lies in how these template objects are registered within the WordPress content model. By registering the mzb-builder-template post type with a capability_type of 'post', the plugin inadvertently inherits the default permission structure associated with standard blog posts rather than enforcing stricter administrative controls appropriate for site-wide layout modifications.
This architectural decision exposes significant security risks because it aligns template management permissions with those granted to lower-privileged user roles, such as Contributors and Authors. In a typical WordPress environment, contributors have limited capabilities focused on creating their own content but lack the authority to modify global site settings or other users' published work. However, due to this misconfiguration, any authenticated user possessing at least contributor-level access can interact with these template objects via the REST API. The vulnerability is further exacerbated by the accessibility of the _mzb_template meta key, which allows any user with edit_posts capability to trigger the vulnerable save_post hook without proper authorization checks ensuring they are acting on their own content or have explicit administrative override permissions.
The operational impact of this flaw is severe and multifaceted. An attacker leveraging this vulnerability can demote administrator-owned published builder templates from a live, active status to draft status effectively removing them from public view. Simultaneously, the attacker can replace these critical structural components with block content authored by themselves that renders site-wide across all pages utilizing those template sections. This capability transforms what might seem like a minor configuration error into a potent vector for website defacement, where an attacker can alter the visual presentation and branding of the entire site to display malicious or inappropriate material. Furthermore, this access enables sophisticated phishing attacks by allowing attackers to inject deceptive login forms or fraudulent content that appears legitimate due to its integration within trusted template structures. Additionally, SEO spam becomes a viable attack vector as attackers can insert hidden links or keyword-stuffed content into these globally rendered templates, potentially harming the site's search engine rankings and reputation while driving malicious traffic.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, specifically reflecting an authorization bypass where standard user roles are granted privileges reserved for administrators. It also maps to ATT&CK technique T1053 Scheduled Task/Job, as the save_post hook acts as a trigger mechanism that executes unauthorized code changes upon specific events, and potentially T1498 Network Denial of Service if the defacement leads to significant operational disruption or reputational damage requiring remediation efforts. The exploitation path relies on authenticated access, meaning attackers must first compromise valid user credentials with at least contributor-level privileges before they can execute this chain of actions against high-value administrative assets like global templates.
Mitigation strategies should prioritize immediate updates to the latest patched version of the plugin if available from the official repository. For environments where updating is not immediately feasible, administrators should consider restricting REST API access for lower-privileged users or implementing additional server-side validation layers that verify administrator-level permissions before processing save_post hooks related to template modifications. It is also advisable to audit user roles and capabilities within WordPress to ensure that no unnecessary elevated privileges are assigned to non-administrative accounts. Regular monitoring of post type changes and meta key updates can help detect unauthorized attempts to modify critical site structures, providing an early warning system for potential exploitation activities targeting these authorization flaws.