What is the CVSS score of CVE-2026-32489?

CVE-2026-32489 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of B Blocks are affected by CVE-2026-32489?

Organizations using Missing Authorization vulnerability in bPlugins B Blocks b-blocks should be aware of notable risk from CVE-2026-32489, a missing authorization vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-32489?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

B Blocks CVE-2026-32489

EUVD-2026-15831 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-j2xj-f4v6-7rwg

Authentication Bypass B Blocks

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.30

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15831

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

AnalysisAI

Improper access control in bPlugins B Blocks versions prior to 2.0.30 allows unauthenticated remote attackers to modify data and degrade system availability through misconfigured security levels. The vulnerability requires no user interaction and can be exploited over the network, affecting the integrity and availability of affected installations.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a weakness in access control implementation within the B Blocks plugin for WordPress (cpe:2.3:a:bplugins:b_blocks:*:*:*:*:*:*:*:*). B Blocks is a WordPress plugin that provides reusable block components and content building functionality. The root cause involves improperly configured or missing authorization checks that fail to enforce privilege separation and role-based access control. Rather than a cryptographic or protocol-level flaw, this is an application logic defect where the plugin fails to validate user permissions before granting access to sensitive operations or data. The vulnerability affects all versions from an unspecified baseline through version 2.0.29, suggesting the issue was present across a broad version range until remediated in 2.0.30.

RemediationAI

Immediately upgrade B Blocks to version 2.0.30 or later through the WordPress plugin update mechanism or by manually downloading the patched version from the official bPlugins repository. Before patching, verify that your WordPress installation is fully backed up. If immediate patching is not feasible, implement network-level access restrictions to limit exposure of the affected WordPress installation to trusted IP addresses or behind a Web Application Firewall (WAF) configured to restrict access to plugin functionality. Additionally, audit user roles and capabilities within WordPress to ensure least-privilege principles are enforced, and consider temporarily disabling the B Blocks plugin if it is not actively in use. Monitor WordPress audit logs and plugin activity for any signs of unauthorized access exploitation while awaiting patch deployment.