Lazy Blocks < 3.0.0 - Unauthenticated RCE

Description

The plugin does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.