WordPress Plugin Vulnerabilities

Custom Block Builder – Lazy Blocks < 4.2.1 - Contributor+ Remote Code Execution

Description

The plugin is vulnerable to Remote Code Execution via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affects Plugins

Plugin icon
lazy-blocks
Fixed in 4.2.1

References

CVE
CVE-2026-1560
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b1853c88-277b-4955-b042-aeed1cffb49b

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Youssef Elouaer
Verified
No
WPVDB ID
f9e25b34-a62f-4795-bed2-c783ca97f87b

Timeline

Publicly Published
2026-02-10 (about 6 months ago)
Added
2026-02-10 (about 6 months ago)
Last Updated
2026-02-11 (about 6 months ago)

Other

Published
Title
Published
2017-09-16
Title
VaultPress 1.89-1.9 - Unauthenticated RCE
Published
2018-08-26
Title
Plainview Activity Monitor < 20180826 - Remote Command Execution (RCE)
Published
2025-04-25
Title
Anps Theme plugin < 1.1.2 - Unauthenticated Arbitrary Shortcode Execution
Published
2026-03-12
Title
Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution
Published
2024-12-18
Title
Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution