What is the CVSS score of EUVD-2026-25372?

EUVD-2026-25372 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

MaxiBlocks Builder EUVD-2026-25372

| CVE-2026-2028 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-24 Wordfence

GHSA-xqqc-58qj-9w8r

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 04:31 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 04:00 euvd

EUVD-2026-25372

Analysis Generated

Apr 24, 2026 - 04:00 vuln.today

CVE Published

Apr 24, 2026 - 03:27 nvd

MEDIUM 5.3

DescriptionCVE.org

The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_custom_image_size' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files in the wp-content/uploads directory, including files uploaded by other users and administrators.

AnalysisAI

MaxiBlocks Builder plugin for WordPress up to version 2.1.8 allows authenticated attackers with Author-level access to delete arbitrary files in the wp-content/uploads directory via the 'maxi_remove_custom_image_size' AJAX action due to insufficient file ownership validation. This enables deletion of media uploaded by other users and administrators without proper authorization checks, violating file integrity despite the CVSS 5.3 score reflecting limited direct impact.

Technical ContextAI

MaxiBlocks Builder is a WordPress page builder plugin that includes image manipulation functionality. The vulnerability exists in the 'maxi_remove_custom_image_size' AJAX action within the class-maxi-image-crop.php file. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), wherein the plugin fails to verify file ownership before allowing deletion. WordPress typically restricts file operations through capability checks (e.g., 'delete_others_posts'), but this plugin's AJAX handler bypasses those checks by not validating that the requesting author owns the file being deleted. The vulnerability affects the wp-content/uploads directory structure, where media files are stored with ownership metadata.

RemediationAI

Update MaxiBlocks Builder to version 2.1.9 or later, which includes fixes to properly validate file ownership before allowing deletion via the 'maxi_remove_custom_image_size' AJAX action. The patch has been released as confirmed by the WordPress.org plugin repository changeset 3476709. Until patching is possible, restrict Author-level access to only trusted users who should have full media library privileges, and review WordPress user roles to ensure that Author-level permissions are assigned appropriately. Additionally, implement file-level backup procedures for the wp-content/uploads directory to enable rapid recovery of deleted files. Monitor AJAX activity for the 'maxi_remove_custom_image_size' action using security plugins or WAF rules to detect suspicious file deletion patterns.