What is the CVSS score of CVE-2026-6703?

CVE-2026-6703 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-6703

EUVD-2026-24069 MEDIUM

Missing Authorization (CWE-862)

2026-04-21 Wordfence

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 07:26 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 07:15 euvd

EUVD-2026-24069

Analysis Generated

Apr 21, 2026 - 07:15 vuln.today

CVE Published

Apr 21, 2026 - 06:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global site-wide plugin configuration options, including toggling custom CSS, disabling blocks, changing layout defaults such as content width, container padding, and container gap, and altering auto-block-recovery behavior.

AnalysisAI

Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress versions up to 2.2.1 allows authenticated contributors and higher to modify global site-wide plugin configuration, including custom CSS settings, block availability, layout defaults (content width, padding, gap), and auto-recovery behavior due to missing authorization checks. This capability escalation bypasses intended role-based access control, enabling lower-privileged users to degrade site functionality and inject CSS-based attacks. No public exploit code or active exploitation confirmed at time of analysis; CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact, but real-world risk depends on contributor population and site governance.

Technical ContextAI

The vulnerability exists in the Responsive Blocks plugin (identified as 'responsive-block-editor-addons' in WordPress plugin repository), a page builder tool that extends WordPress block editor functionality with custom blocks, patterns, and site-wide configuration options. The root cause is CWE-862 (Missing Authorization), manifesting as absent or improperly implemented capability checks in WordPress action/filter handlers that manage global plugin settings. WordPress role-based access control typically restricts 'manage_options' capability to administrators, but this plugin's configuration endpoints fail to verify such capability before processing requests from contributors (who normally only have 'edit_posts'). The affected code paths include settings handlers for CSS customization, block registry toggles, layout parameter defaults, and recovery behavior - all of which are global in scope and should be restricted to administrators. CPE indicates all versions through 2.2.1 of the 'cyberchimps:responsive_blocks_-_page_builder_for_blocks_&_patterns' package are affected.

RemediationAI

Update the Responsive Blocks plugin to version 2.2.2 or later, which adds proper authorization checks to global configuration endpoints. Install the update immediately via WordPress admin dashboard (Plugins > Updates) or via command-line using wp-cli (wp plugin update responsive-block-editor-addons). For sites unable to update immediately, disable or restrict contributor role assignments to trusted users only, using WordPress role management tools or a role editor plugin to audit and reduce privileges; note that this is a workaround only and does not fix the underlying authorization flaw. Additionally, monitor WordPress user audit logs (via a security plugin such as Wordfence, iThemes Security, or WP Activity Log) for suspicious configuration changes from non-administrator accounts, and consider using WordPress multisite with strict role controls to compartmentalize access. Refer to Wordfence vulnerability alert (https://www.wordfence.com/threat-intel/vulnerabilities/id/187b072d-6314-4ac1-a924-b14324b2fd8d) and WordPress plugin repository for patched version availability.