CVE-2026-75017: WordPress Magazine Blocks Auth Bypass Flaw

CVE-2026-75017 Overview

CVE-2026-75017 is an authorization bypass vulnerability in the Magazine Blocks plugin for WordPress, affecting all versions up to and including 1.8.6. The plugin fails to verify user authorization before allowing modification of site builder templates. Authenticated attackers with contributor-level access or above can demote administrator-owned published builder templates to draft status. They can then replace them with attacker-authored block content rendered site-wide. Impacted templates include header, footer, front page, single, archive, 404, and search templates. This creates opportunities for defacement, phishing lures, and search engine optimization (SEO) spam injection.

Critical Impact

Contributor-level accounts can overwrite site-wide builder templates, enabling defacement and phishing attacks against all site visitors.

Affected Products

• Magazine Blocks WordPress plugin versions up to and including 1.8.6
• WordPress sites with the plugin installed and contributor-or-above user accounts
• Sites relying on the mzb-builder-template custom post type for header, footer, front page, single, archive, 404, or search templates

Discovery Timeline

• 2026-09-18 - CVE CVE-2026-75017 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-75017

Vulnerability Analysis

The vulnerability is a missing authorization flaw classified as [CWE-862]. The Magazine Blocks plugin registers the mzb-builder-template custom post type with capability_type='post' and exposes it via the WordPress REST API. Because the post type inherits standard post capabilities, any user with the edit_posts capability can interact with it. The _mzb_template meta key is likewise accessible to any user holding edit_posts. Contributor-level users possess edit_posts by default, allowing them to trigger the vulnerable save_post() hook and manipulate templates owned by administrators.

Root Cause

The root cause is improper capability mapping and missing per-object authorization checks. The plugin does not implement a dedicated capability_type or map_meta_cap handler restricting write access to administrators. Contributors can therefore invoke template save logic through standard WordPress REST endpoints without triggering an access denial.

Attack Vector

An authenticated attacker with contributor privileges sends REST API requests targeting the mzb-builder-template post type. The attacker demotes an administrator-owned published template to draft status and creates a replacement template containing attacker-controlled block content. Because builder templates render site-wide across headers, footers, and other structural areas, the injected content is served to every visitor. Exploitation requires no user interaction and can be automated with a valid contributor session token.

No public exploitation code is available at the time of publication. See the Wordfence Vulnerability Analysis and the WordPress SiteBuilder Code Snippet for the vulnerable registration logic.

Detection Methods for CVE-2026-75017

Indicators of Compromise

• Administrator-owned mzb-builder-template posts transitioning to draft status without a corresponding administrator action in the audit log.
• New mzb-builder-template posts authored by contributor-level accounts, especially those set as active header, footer, or front page templates.
• Unexpected outbound links, iframes, or SEO spam content appearing across all pages of a WordPress site.

Detection Strategies

• Review the WordPress wp_posts table for post_type = 'mzb-builder-template' entries and correlate post_author against user roles.
• Monitor REST API traffic to /wp-json/wp/v2/mzb-builder-template endpoints for POST, PUT, and PATCH requests from non-administrator accounts.
• Alert on save_post events targeting the _mzb_template meta key when initiated by users below the administrator role.

Monitoring Recommendations

• Enable WordPress activity logging with per-user attribution for post status transitions on custom post types.
• Ingest web server access logs into a centralized analytics platform and baseline REST API usage patterns for contributor accounts.
• Track file integrity and rendered page hashes for site-wide template regions to detect unauthorized content substitution.

How to Mitigate CVE-2026-75017

Immediate Actions Required

• Update the Magazine Blocks plugin to a version later than 1.8.6 as soon as the vendor patch is available.
• Audit all existing mzb-builder-template posts, restore any administrator-owned templates demoted to draft, and remove suspicious contributor-authored templates.
• Review contributor-level and above accounts for signs of compromise and rotate credentials where appropriate.

Patch Information

The vendor addressed the issue in a code change tracked by the WordPress MagazineBlocks Changeset. Site administrators should install the patched release via the WordPress plugin updater and confirm the installed version is above 1.8.6.

Workarounds

• Temporarily deactivate the Magazine Blocks plugin until the patched version is installed.
• Restrict contributor account creation and demote unnecessary contributor-level accounts to subscriber where feasible.
• Deploy a web application firewall rule blocking non-administrator REST API writes to the mzb-builder-template post type.

# Example WordPress CLI audit for suspicious builder templates
wp post list --post_type=mzb-builder-template \
  --fields=ID,post_title,post_status,post_author,post_date \
  --format=table

# Identify author roles for template posts
wp user list --fields=ID,user_login,roles --format=table