Cozy Blocks CVE-2026-97070

Exploitation requires that the target WordPress installation has the CozyThemes Cozy Blocks (cozy-addons) plugin installed and active at version 2.2.23 or earlier. The flaw lies in plugin functionality that accepts a user-controlled object/key reference without a proper authorization check (CWE-639), so an attacker reaching that endpoint over the network can reference resources they do not own. Per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special attack prerequisites are stated, and impact is limited to low confidentiality disclosure (VI:N/VA:N) - the primary limiting factors are that only sites running the vulnerable plugin version are affected and that the data exposure is bounded rather than enabling modification or takeover.

This is a moderate-severity authorization bypass (IDOR, CWE-639) in the CozyThemes Cozy Blocks WordPress plugin, scored CVSS 4.0 6.9 by the reporting source (Patchstack). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) indicates network-reachable, low-complexity, unauthenticated exploitation with LOW confidentiality impact only and NO integrity or availability impact - meaning the realistic outcome is unauthorized disclosure of a limited set of data via manipulated object references, not full compromise. No EPSS score, no CISA KEV listing, and no public POC were supplied in the input, so there is no signal of active or widespread exploitation at this time; the exploitation status is therefore 'no public exploit identified at time of analysis.' Weighing the signals together, this is a real but lower-priority issue: the unauthenticated network vector and low complexity make it easy to attempt, but the confined confidentiality-only impact and lack of any exploitation evidence argue against emergency treatment. One point to verify: the CWE-639 user-controlled-key pattern typically presupposes some object/resource context, yet the vector asserts PR:N - confirm with the vendor/Patchstack advisory whether truly no authentication is required or whether a subscriber-level account is needed, as this materially changes real-world risk.

An attacker interacts with a Cozy Blocks plugin endpoint on a target WordPress site and substitutes or increments a user-controlled identifier (object key) in a request to reference records belonging to other users or scopes. Because access control is incorrectly configured, the server returns data the attacker is not authorized to view, enabling unauthorized disclosure of limited information. No public exploit code was identified in the provided data, and the CVSS vector indicates this requires no authentication, no user interaction, and low attack complexity.