EUVD-2026-54892
GHSA-gf2c-5g46-3crp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Contributor role maps to PR:L not PR:H; network REST endpoint with no complexity; CSS-only impact yields no confidentiality loss and limited integrity and availability.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
AnalysisAI
Nexter Blocks WordPress plugin before 5.0.2 exposes a REST endpoint for saving global CSS that any Contributor-level user can invoke without proper authorization, causing injected styles to render site-wide for all visitors. The attack surface is limited to sites with untrusted Contributor accounts, and impact is constrained to front-end defacement, content suppression, and UI redressing - not code execution or data exfiltration. No public exploit code or active exploitation has been identified; EPSS of 0.10% at the 1st percentile confirms negligible exploitation probability at this time.
Technical ContextAI
Nexter Blocks is a Gutenberg-compatible block library for WordPress that extends the block editor with page-building capabilities. The vulnerability exists in a REST API endpoint the plugin provides for persisting global CSS, which is applied to every page of the site at render time. The missing control is authorization: the endpoint does not verify that the requesting user holds a role with sufficient trust to modify site-wide presentation assets. CWE-345 (Insufficient Verification of Data Authenticity) is assigned, though CWE-862 (Missing Authorization) would be a more precise characterization - the flaw is a missing capability check on the REST route, not a cryptographic authenticity problem. All Nexter Blocks releases from 0 up to (but not including) 5.0.2 are confirmed affected per EUVD-2026-54892. The 'Information Disclosure' tag in the source intelligence appears to be a mis-tagging; the actual impact class is integrity (unauthorized data write), not disclosure.
RemediationAI
Update the Nexter Blocks plugin to version 5.0.2 or later, the confirmed patched release per WPScan and EUVD data. Updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or via WP-CLI with 'wp plugin update nexter-blocks'. If immediate patching is not feasible, administrators should audit and revoke Contributor-role accounts for any users who should not have editorial access, and disable open user registration if the site does not require it - these steps eliminate the required foothold for exploitation. The trade-off of restricting Contributor access is reduced editorial workflow capacity on multi-author sites. Advisory references: WPScan (https://wpscan.com/vulnerability/a702e5cb-0fb3-419e-81df-fa5b26c81402/) and VulDB (https://vuldb.com/vuln/387245).
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today