CVE-2026-97070 Overview
CVE-2026-97070 is an Insecure Direct Object Reference (IDOR) vulnerability in the CozyThemes Cozy Blocks (cozy-addons) WordPress plugin. The flaw is classified as Authorization Bypass Through User-Controlled Key [CWE-639] and affects all versions up to and including 2.2.23. An unauthenticated remote attacker can manipulate user-controlled identifiers to access resources they are not authorized to view. The vulnerability requires no authentication, no user interaction, and can be exploited over the network against any WordPress site running the affected plugin.
Critical Impact
Unauthenticated attackers can bypass access control checks by supplying crafted object identifiers, leading to disclosure of resources intended for other users.
Affected Products
- CozyThemes Cozy Blocks (cozy-addons) WordPress plugin
- All versions from n/a through 2.2.23
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2026-10-05 - CVE-2026-97070 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-97070
Vulnerability Analysis
The vulnerability stems from an incorrectly configured access control check within the Cozy Blocks plugin. The plugin accepts an identifier supplied by the client and uses it to retrieve or operate on an object without verifying that the requester is authorized for that specific object. This pattern is the canonical signature of an Insecure Direct Object Reference, tracked under [CWE-639]. Because the exposed endpoints do not require authentication, any unauthenticated client on the network can enumerate or request arbitrary object identifiers. The disclosed data is limited in scope relative to a full compromise, but the information surfaced can support reconnaissance and follow-on attacks against the WordPress site.
Root Cause
The root cause is a missing authorization check tied to a user-supplied key. The affected handlers trust the identifier passed in the request parameters as proof of ownership rather than enforcing a server-side permission check that binds the object to the requesting principal.
Attack Vector
Exploitation occurs over the network against the plugin's exposed endpoints. An attacker sends HTTP requests containing modified object identifiers to the vulnerable endpoint and receives data that should be restricted. No credentials or user interaction are required. See the Patchstack CVE Analysis for Cozy Addons for the vendor-level technical write-up.
No verified public exploit code is available at the time of writing.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-97070
Indicators of Compromise
- Sequential or enumerated numeric identifiers appearing in request parameters to Cozy Blocks plugin endpoints.
- Unauthenticated HTTP requests to cozy-addons AJAX or REST routes returning object data.
- Spikes in 200-OK responses from plugin endpoints originating from a single source IP.
Detection Strategies
- Review WordPress and web server access logs for repeated requests to Cozy Blocks endpoints with varying id parameters.
- Deploy a Web Application Firewall (WAF) rule to flag ID enumeration patterns against /wp-admin/admin-ajax.php or /wp-json/ routes tied to cozy-addons.
- Baseline normal traffic volume to Cozy Blocks endpoints and alert on deviations.
Monitoring Recommendations
- Forward WordPress access and PHP error logs to a centralized SIEM for correlation.
- Monitor for anomalous unauthenticated requests referencing plugin paths containing cozy-addons or cozy-blocks.
- Track outbound data volumes from the WordPress host to identify potential bulk extraction.
How to Mitigate CVE-2026-97070
Immediate Actions Required
- Inventory all WordPress sites and identify instances running Cozy Blocks cozy-addons version 2.2.23 or earlier.
- Restrict external access to the plugin's endpoints via WAF or reverse proxy rules until a patched version is applied.
- Audit logs for prior exploitation attempts matching the detection strategies above.
Patch Information
At the time of publication, the NVD entry lists the affected range as "from n/a through 2.2.23." Administrators should consult the Patchstack advisory and the CozyThemes vendor site for the fixed release version and upgrade immediately once available.
Workarounds
- Temporarily deactivate the Cozy Blocks plugin if no patched version is available for your environment.
- Add WAF rules to block unauthenticated access to Cozy Blocks REST and AJAX endpoints.
- Enforce authentication on /wp-json/ routes using an access-restriction plugin where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
