CVE-2026-75017 wpblockart CVE debrief

Who should care

Defenders responsible for WordPress installations using the Magazine Blocks plugin, particularly those with contributor-level access or above, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-75017 is a medium-severity vulnerability in the Magazine Blocks plugin for WordPress, allowing contributors and above to bypass authorization and modify sensitive template content. Defenders should prioritize verifying exposure, assessing security, and restricting access to sensitive content.

• Defacement of website content through replacement of administrator-owned templates
• Phishing campaigns leveraging modified templates to target site visitors
• SEO spam injection through manipulation of template content
• Verification of exposure and assessment of security for WordPress installations using the vulnerable plugin

Technical summary

The Magazine Blocks plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with contributor-level access and above to demote administrator-owned published builder templates to draft status and replace them with attacker-authored block content. The plugin's improper authorization checks enable contributors and above to access and modify sensitive template content, potentially leading to defacement, phishing, and SEO spam. Defenders should prioritize verifying exposure and assessing the security of their WordPress installations using the vulnerable plugin.

Defensive priority

Defenders should prioritize verifying exposure and assessing the security of their WordPress installations using the vulnerable plugin.

Recommended defensive actions

• Verify the version of the Magazine Blocks plugin and update to a patched version if necessary
• Assess the security of WordPress installations using the vulnerable plugin
• Restrict access to sensitive template content and modify permissions for contributors and above
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is due to improper authorization checks in the plugin, allowing contributors and above to access and modify sensitive template content. The plugin's mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability. This means contributor-level users and above can trigger the vulnerable save_post() hook. The CVE record was published on 2026-09-18T07:16:50.113Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.