CVE-2026-19948: Cozy Blocks WordPress Auth Bypass Vulnerability

CVE-2026-19948 Overview

CVE-2026-19948 is an authorization bypass vulnerability in the Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress. The flaw affects all plugin versions up to and including 2.2.17. The plugin fails to verify that a user is authorized before returning WooCommerce product data through its block-rendering handlers. Unauthenticated attackers can retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products that site owners never intended to expose publicly.

Critical Impact
Unauthenticated remote attackers can enumerate non-public WooCommerce product metadata, exposing unreleased pricing, unpublished inventory, and confidential catalog data.

Affected Products

Cozy Blocks (cozy-addons) WordPress plugin, versions up to and including 2.2.17
WordPress sites running WooCommerce alongside the vulnerable plugin
Any site rendering Cozy Blocks Featured Product, Featured Product Tabs, Product Tab, or Wishlist blocks

Discovery Timeline

2026-09-01 - CVE-2026-19948 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-19948

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-862] in the Cozy Blocks plugin's WooCommerce integration. Multiple block renderers, including featured-product-tabs/render.php, featured-product/render.php, product-tab/render.php, and wishlist/render.php, emit a sidebarNonce value into public page HTML without gating output behind a login check. The nonce is intended to authenticate privileged actions but is disclosed to any anonymous visitor who loads a page containing one of these blocks.

Backend handlers defined in includes/functions.php around lines 1087, 1117, and 1205 accept the harvested sidebarNonce as the sole authentication check. When the nonce validates, the handler returns WooCommerce product records regardless of post status. This bypasses the visibility controls that WordPress and WooCommerce enforce for draft, pending, private, and catalog-hidden products.

Root Cause

The root cause is reliance on a WordPress nonce as an authorization boundary. Nonces provide replay and CSRF protection, not access control. Because the plugin emits the nonce in public HTML and the handler performs no capability check with current_user_can() or a post-status filter, authorization is effectively absent.

Attack Vector

An unauthenticated attacker loads any public page rendering a vulnerable Cozy Blocks component. The attacker parses the response for the sidebarNonce value, then issues AJAX or REST requests to the plugin's product-fetching endpoints while supplying the harvested nonce. The handler returns metadata for non-public products, allowing enumeration of unlaunched SKUs, staged pricing, and hidden catalog items.

No exploitation code is required beyond standard HTTP tooling. See the Wordfence Vulnerability Analysis and the WordPress Cozy Addons Functions File Line 1087 for the vulnerable handler source.

Detection Methods for CVE-2026-19948

Indicators of Compromise

Repeated unauthenticated POST or GET requests to Cozy Blocks AJAX or REST endpoints from a single source IP
Access log entries showing anonymous clients supplying a sidebarNonce parameter to plugin handlers
Bursts of requests correlating to product ID enumeration patterns against WooCommerce endpoints
Outbound scraping of pages containing Featured Product, Product Tab, or Wishlist blocks by non-browser user agents

Detection Strategies

Inspect web server logs for high-volume requests targeting cozy-addons handlers referenced in includes/functions.php
Compare returned product IDs against WooCommerce post status; unauthenticated responses returning non-publish products indicate exploitation
Deploy WordPress security plugin rules that flag anonymous nonce reuse against the Cozy Blocks endpoints

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and admin-ajax.php with source IP retention
Alert on anomalous outbound traffic patterns from scrapers targeting WooCommerce product surfaces
Track the Cozy Blocks plugin version across all managed WordPress sites to identify unpatched hosts

How to Mitigate CVE-2026-19948

Immediate Actions Required

Update the Cozy Blocks plugin to the version that follows 2.2.17 as soon as the vendor publishes a fix
Audit WooCommerce products in draft, pending, private, and catalog-hidden status for sensitivity of exposed metadata
Rotate any product data that constitutes confidential business information if pre-patch exposure is suspected
Review web access logs for prior enumeration activity against Cozy Blocks endpoints

Patch Information

The vendor changeset is tracked in the WordPress Cozy Addons Changeset Overview. Site operators should install the latest Cozy Blocks release from the WordPress plugin repository and verify the vulnerable handlers in includes/functions.php now enforce authorization checks in addition to nonce validation.

Workarounds

Deactivate the Cozy Blocks plugin on sites where WooCommerce non-public products contain confidential data until patched
Remove Featured Product, Featured Product Tabs, Product Tab, and Wishlist blocks from public pages to suppress sidebarNonce disclosure
Restrict access to admin-ajax.php and REST endpoints handling Cozy Blocks queries via a web application firewall rule that requires authenticated sessions
Limit WooCommerce product visibility metadata by minimizing sensitive content in draft records until the plugin is updated

bash

# Example WAF rule concept: block anonymous requests carrying sidebarNonce to Cozy Addons handlers
SecRule REQUEST_URI "@rx (admin-ajax\.php|wp-json)" \
  "chain,phase:2,deny,status:403,id:1029948,msg:'Block anonymous Cozy Blocks product fetch'"
SecRule ARGS_NAMES "@streq sidebarNonce" \
  "chain"
SecRule REQUEST_COOKIES:wordpress_logged_in_* "@rx ^$"