EUVD-2026-24069Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global site-wide plugin configuration options, including toggling custom CSS, disabling blocks, changing layout defaults such as content width, container padding, and container gap, and altering auto-block-recovery behavior.
AnalysisAI
Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress versions up to 2.2.1 allows authenticated contributors and higher to modify global site-wide plugin configuration, including custom CSS settings, block availability, layout defaults (content width, padding, gap), and auto-recovery behavior due to missing authorization checks. This capability escalation bypasses intended role-based access control, enabling lower-privileged users to degrade site functionality and inject CSS-based attacks. No public exploit code or active exploitation confirmed at time of analysis; CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact, but real-world risk depends on contributor population and site governance.
Technical ContextAI
The vulnerability exists in the Responsive Blocks plugin (identified as 'responsive-block-editor-addons' in WordPress plugin repository), a page builder tool that extends WordPress block editor functionality with custom blocks, patterns, and site-wide configuration options. The root cause is CWE-862 (Missing Authorization), manifesting as absent or improperly implemented capability checks in WordPress action/filter handlers that manage global plugin settings. WordPress role-based access control typically restricts 'manage_options' capability to administrators, but this plugin's configuration endpoints fail to verify such capability before processing requests from contributors (who normally only have 'edit_posts'). The affected code paths include settings handlers for CSS customization, block registry toggles, layout parameter defaults, and recovery behavior - all of which are global in scope and should be restricted to administrators. CPE indicates all versions through 2.2.1 of the 'cyberchimps:responsive_blocks_-_page_builder_for_blocks_&_patterns' package are affected.
RemediationAI
Update the Responsive Blocks plugin to version 2.2.2 or later, which adds proper authorization checks to global configuration endpoints. Install the update immediately via WordPress admin dashboard (Plugins > Updates) or via command-line using wp-cli (wp plugin update responsive-block-editor-addons). For sites unable to update immediately, disable or restrict contributor role assignments to trusted users only, using WordPress role management tools or a role editor plugin to audit and reduce privileges; note that this is a workaround only and does not fix the underlying authorization flaw. Additionally, monitor WordPress user audit logs (via a security plugin such as Wordfence, iThemes Security, or WP Activity Log) for suspicious configuration changes from non-administrator accounts, and consider using WordPress multisite with strict role controls to compartmentalize access. Refer to Wordfence vulnerability alert (https://www.wordfence.com/threat-intel/vulnerabilities/id/187b072d-6314-4ac1-a924-b14324b2fd8d) and WordPress plugin repository for patched version availability.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today