Magazine Blocks CVE-2026-78290

Exploitation requires the attacker to hold at minimum a Contributor-level WordPress account (CVSS PR:L confirmed); sites where contributor registration is open or where credentials have been compromised are the primary risk group. Victim interaction is mandatory (CVSS UI:R): a higher-privileged user such as an editor or administrator must actively load the page or post containing the injected payload. The Magazine Blocks plugin must be active and running version 1.8.6 or earlier. Exploitation is effectively blocked on sites that disable open registration, enforce strong account vetting for the Contributor role, or do not use the Magazine Blocks plugin - these limiting conditions substantially reduce real-world exploitability beyond what the raw CVSS score implies.

The CVSS 6.5 Medium score reflects a network-accessible flaw (AV:N) with low complexity (AC:L) and a scope change (S:C), partially offset by the low-privilege authentication prerequisite (PR:L - Contributor role) and mandatory user interaction (UI:R). EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified from this dataset. The absence of KEV listing and no known POC keep this in theoretical exploitation territory. Even a mid-sized municipal IT team in mielec should treat this as a priority patch if their WordPress deployments permit open contributor registration, since that registration policy is precisely what converts a medium CVSS score into an actionable near-term risk. Sites with locked-down user registration or no Magazine Blocks installation face negligible exposure.

An attacker registers or obtains a Contributor-level account on a WordPress site running Magazine Blocks 1.8.6, then crafts a post or page embedding a malicious JavaScript payload within a Magazine Blocks element. When a site administrator or editor loads the affected page - for instance during content review - the script executes in their browser, potentially harvesting the administrator's session cookie or silently performing privileged WordPress actions such as creating a backdoor admin account.