What is the CVSS score of CVE-2026-15420?

CVE-2026-15420 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.6%.

Nexter Blocks CVE-2026-15420

EUVD-2026-48464 MEDIUM

Path Traversal (CWE-22)

2026-07-24 Wordfence

GHSA-cg9r-cc95-vm62

WordPress Denial Of Service Path Traversal Wordpress Plugin Nexter Blocks Gutenberg Blocks Page Builder Ai Website Builder Posimyththemes

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

Deletion of plugin and theme CSS/JS assets constitutes an availability impact, warranting A:L over the NVD-assigned A:N; PR:L reflects the confirmed subscriber-level authentication requirement.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:04 vuln.today

CVE Published

Jul 24, 2026 - 02:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Nexter Blocks - Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary JS/CSS files on the server, which can lead to denial of service or destruction of critical plugin and theme assets.

AnalysisAI

Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.

Technical ContextAI

The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly called path traversal. The affected code resides in the plugin's tp-registered-blocks.php class file, as confirmed by multiple WordPress plugin trac references pointing to lines 2710, 2862, 2985, and 3521 within that file across versions 4.7.14 and 4.7.17. The 'plus_name' parameter is passed into a file operation without adequate canonicalization or boundary enforcement, allowing sequences such as '../../' to escape the intended directory and reference arbitrary locations on the server filesystem. The CPE identifier cpe:2.3:a:posimyththemes:nexter_blocks_-_gutenberg_blocks,_page_builder_&_ai_website_builder:*:*:*:*:*:*:*:* confirms the vendor (posimyththemes) and establishes that all released versions up to and including 5.0.0 carry the flaw. Because the operation performs file deletion rather than read or write, confidentiality is unaffected, but integrity and - contrary to the NVD-assigned A:N - availability are both impacted when plugin or theme JS/CSS assets are removed.

RemediationAI

Update the Nexter Blocks plugin to the version released after the fix committed in WordPress trac changeset 3614203 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3614203%40the-plus-addons-for-block-editor&new=3614203%40the-plus-addons-for-block-editor). The exact patched release version number is not independently confirmed from the provided data - administrators should update to the latest available version from the WordPress plugin repository and verify it supersedes 5.0.0. As an immediate compensating control while patching is scheduled, disable the Nexter Blocks plugin entirely on sites where it is not actively in use; this eliminates the vulnerable endpoint with the trade-off of losing Gutenberg block functionality. For sites with open user registration, disabling open registration or restricting it to trusted roles eliminates the ability for unknown parties to obtain the subscriber-level access required for exploitation. Restricting file-system permissions so the web server user cannot delete files outside the plugin's own asset directory would also limit blast radius, though this requires server-level access and may affect other plugin functionality.