Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:08 UTC
CVE-2026-127048
The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 15, 2026 06:00:08 UTC
PublishedNov 15, 2026 06:00:08 UTC
ReservedNov 12, 2026 12:08:49 UTC
Credits
- Mirza Muhammad Sanaullah
- WPScan