EUVD-2026-40936
GHSA-69gg-pvp7-2fx5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable REST endpoint requires only Author-level credentials (PR:L); no confidentiality or availability impact; integrity limited to style data modification.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own - including site-wide surfaces via the reserved 'template' and 'widget' page_id values - enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint's permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.
AnalysisAI
Insecure Direct Object Reference in the Qi Blocks WordPress plugin (all versions ≤ 1.4.9) allows any authenticated user with Author-level access to overwrite the stored global styles of arbitrary posts, templates, or widgets they do not own by manipulating the unvalidated 'page_id' parameter. Critically, the reserved 'template' and 'widget' page_id values expose site-wide surfaces, enabling an Author to deface, hide content on, or visually degrade any page across the entire WordPress installation. The permission_callback validates only generic edit_posts and publish_posts capabilities rather than post ownership, meaning the built-in Author role is sufficient for exploitation. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the application uses an attacker-controlled value - the 'page_id' POST parameter - as the key to select and modify a data record, without verifying that the authenticated user has ownership rights over the targeted record. The vulnerable endpoint is implemented in class-qi-blocks-framework-global-styles.php (lines 82, 134, and 142 in the 1.4.9 tag per the plugin's Trac repository), which handles saving of per-page Qi Blocks styling data. The permission_callback gates access on WordPress capabilities edit_posts and publish_posts, which are granted to the built-in Author role by default in all standard WordPress installations, but performs no secondary ownership check against the post's post_author field. The reserved synthetic page_id values 'template' and 'widget' compound the risk by mapping to site-wide design surfaces rather than individual user-owned posts. Affected product per CPE: cpe:2.3:a:qodeinteractive:qi_blocks:*:*:*:*:*:*:*:*.
RemediationAI
Upstream fix available (Trac changeset 3572812 at plugins.trac.wordpress.org); a released patched version number beyond 1.4.9 is not independently confirmed from the available data - monitor the WordPress plugin repository for an update and apply it as soon as it is published. Until the patch is applied, site administrators should audit the list of users holding the Author role (or higher) and reduce it to the minimum necessary, as any Author-level account can exploit this flaw. Additionally, administrators can temporarily revoke the edit_posts and publish_posts capabilities from the Author role on sites where contributors do not need to self-publish, though this will prevent Authors from publishing their own posts as a side effect. Web application firewall rules that validate the page_id parameter against a whitelist of the authenticated user's own post IDs at the perimeter are a partial compensating control but are not trivially enforceable for the reserved 'template' and 'widget' values without custom logic. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/64251fd4-1627-49d0-831f-5cb9898c38bf?source=cve) and the plugin Trac changeset (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3572812%40qi-blocks&new=3572812%40qi-blocks&sfp_email=&sfph_mail=) should be monitored for updates.
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputti
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-
The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all ve
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before output
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today