Master Blocks CVE-2026-88824

Exploitation requires (1) a target running Master Blocks for WordPress version 1.4.1 up to but not including 1.5.0, and (2) the specific REST route that lacks an authorization/permission callback being network-reachable - both true in default installs of the vulnerable versions, so no special non-default configuration is needed for the unauthenticated write. The stored payload is inert until the limiting condition is met: an authenticated administrator must visit an affected wp-admin page (UI:R) for the JavaScript to execute in their session. This narrows realistic impact to sites where an admin browses the compromised settings area after the injection.

This is a genuinely high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes network-reachable, low-complexity exploitation requiring no attacker authentication (PR:N) - an unauthenticated actor can write plugin settings via an unprotected REST route. The only gating factor is UI:R: an administrator must subsequently load a wp-admin page for the stored payload to fire in their session. POC/exploit code is publicly available (WPScan), and a vendor patch (1.5.0) exists, which typically accelerates opportunistic scanning of WordPress plugin endpoints. There is no EPSS score, no CISA KEV listing, and no SSVC data in the input, so 'no public exploit identified' does NOT apply here - the correct status is that publicly available exploit code exists but active in-the-wild exploitation is NOT confirmed. The C:H/I:H/A:H impact rating is vendor-generous but defensible: JavaScript executing in an authenticated administrator's session can create rogue admin users, install plugins, or inject backdoors, effectively yielding full site compromise. Net: real priority for exposed WordPress sites running this plugin, tempered only by the required-versions range and admin-visit precondition.

An unauthenticated attacker sends a crafted request to the plugin's unprotected REST route, writing a malicious JavaScript payload into a plugin setting that is later rendered unescaped in the WordPress admin area. When any administrator opens the affected wp-admin page, the script executes in their authenticated session - enabling admin account creation, plugin installation, or backdoor injection. Public exploit code is available via WPScan, lowering the barrier to weaponization.