CVE-2026-15420: Nexter Blocks Path Traversal Vulnerability

CVE-2026-15420 Overview

CVE-2026-15420 is a directory traversal vulnerability in the Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress. The flaw affects all versions up to and including 5.0.0 and is exploitable through the plus_name parameter. Authenticated attackers with subscriber-level access or above can traverse directories to delete arbitrary JS and CSS files on the server. Successful exploitation results in denial of service or destruction of critical plugin and theme assets. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated subscriber-level attackers can delete arbitrary JS/CSS files on the server, leading to denial of service and destruction of plugin and theme assets.

Affected Products

Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress
All plugin versions up to and including 5.0.0
WordPress sites with subscriber-level or higher user registration enabled

Discovery Timeline

2026-07-24 - CVE-2026-15420 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-15420

Vulnerability Analysis

The vulnerability resides in the Nexter Blocks plugin's file handling logic, referenced in classes/tp-registered-blocks.php at multiple locations including lines 2710, 2862, 2985, and 3521. The plugin accepts a plus_name parameter from authenticated users without adequate path sanitization. Because the parameter feeds into file deletion routines, attackers can supply traversal sequences such as ../ to escape the intended directory scope. The result is arbitrary deletion of JavaScript and CSS files anywhere the web server user has write permissions.

The impact is bounded to integrity of static assets, but destruction of core theme or plugin files renders the site inoperable. Attackers can weaponize this to force outages, disable security controls that rely on JS enforcement, or wipe dependencies of other installed plugins.

Root Cause

The root cause is missing input validation on the plus_name parameter before it is passed to a file deletion operation. The affected code paths do not canonicalize the resolved path or restrict deletion to a whitelisted directory. Any authenticated user, including low-privileged subscribers, can invoke the affected AJAX endpoint.

Attack Vector

An attacker registers or compromises a subscriber account on the target WordPress site. The attacker then issues a crafted request to the vulnerable plugin endpoint, supplying a plus_name value containing directory traversal sequences that resolve to files outside the plugin's asset directory. The server processes the deletion without validating the resolved path.

The vulnerability manifests in the plugin's file handling functions. See the Wordfence Vulnerability Report and the WordPress Plugin Change Set for the corrected code.

Detection Methods for CVE-2026-15420

Indicators of Compromise

HTTP requests to Nexter Blocks AJAX endpoints containing plus_name values with ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected deletion of .js or .css files under wp-content/plugins/ or wp-content/themes/ directories.
WordPress site rendering issues, broken layouts, or JavaScript console errors following requests from low-privileged accounts.
Recent creation of subscriber accounts followed by AJAX activity to plugin endpoints.

Detection Strategies

Review web server access logs for POST requests to admin-ajax.php referencing Nexter Blocks actions with suspicious plus_name parameter values.
Deploy file integrity monitoring on wp-content/plugins/ and wp-content/themes/ directories to alert on unauthorized deletions.
Correlate subscriber account authentication events with subsequent AJAX POST requests to plugin action handlers.

Monitoring Recommendations

Enable WordPress audit logging to capture file modification events tied to authenticated user sessions.
Monitor for anomalous 4xx or 5xx spikes on pages that reference deleted static assets, indicating potential exploitation.
Alert on any newly registered subscriber accounts issuing plugin-scoped AJAX requests within a short time window.

How to Mitigate CVE-2026-15420

Immediate Actions Required

Update the Nexter Blocks plugin to the latest patched version above 5.0.0 as soon as it is available from the vendor.
Audit all user accounts and remove any unauthorized or unrecognized subscriber-level registrations.
Verify integrity of files in wp-content/plugins/ and wp-content/themes/ and restore any deleted assets from backup.

Patch Information

Refer to the WordPress Plugin Change Set for the vendor's fix and the Wordfence Vulnerability Report for full remediation guidance. Administrators should apply the patched release from the WordPress plugin repository.

Workarounds

Disable open user registration or restrict the subscriber role until the plugin is patched.
Deploy a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns in the plus_name parameter.
Temporarily deactivate the Nexter Blocks plugin if patching cannot be applied immediately.
Restrict write permissions on wp-content/ directories to the minimum required by the web server user.

bash

# Example WAF rule (ModSecurity) to block traversal in plus_name parameter
SecRule ARGS:plus_name "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1015420,phase:2,deny,status:403,\
     msg:'CVE-2026-15420 Nexter Blocks directory traversal attempt'"