{"id":"CVE-2026-123474","kind":"vulnerability","aliases":["CVE-2026-123474"],"related":[],"title":"WordPress Premium Blocks plugin: missing authorization check through version 2.3.18","description":"Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.","summary":"The Premium Blocks Gutenberg plugin for WordPress lacks a proper authorization check on some functionality. An attacker may be able to perform actions that should be restricted to users with higher access levels.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","premium-blocks-for-gutenberg","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Premium Blocks – Gutenberg Blocks for WordPress plugin (`premium-blocks-for-gutenberg`) in the WordPress admin plugins list.\n- Confirm whether the installed version is `2.3.18` or earlier.","fix":null,"status":"open","published_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:26+00:00","updated_at":"2026-11-07T13:49:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Premium Blocks plugin: missing authorization check through version 2.3.18","impact":"medium","summary":"The Premium Blocks Gutenberg plugin for WordPress lacks a proper authorization check on some functionality. An attacker may be able to perform actions that should be restricted to users with higher access levels.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","premium-blocks-for-gutenberg"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users perform restricted plugin actions on the site","analyst_note":"Find the vendor advisory or Wordfence record to confirm the affected function, required privilege, and the fixed version beyond 2.3.18.","how_to_check":"- Check the installed version of the Premium Blocks – Gutenberg Blocks for WordPress plugin (`premium-blocks-for-gutenberg`) in the WordPress admin plugins list.\n- Confirm whether the installed version is `2.3.18` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Premium Blocks – Gutenberg Blocks for WordPress plugin at version 2.3.18 or earlier are affected. The flaw is an access control gap, so exposure depends on which accounts can reach the affected functionality. Sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4254,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123474':13A,16A '-2026':12A,15A '2.3.18':10A,92C 'abl':43B 'access':55B,77C 'action':46B 'affect':82C 'allow':73C 'attack':40B 'author':6A,34B,58C 'block':3A,20B,26B,63C,65C,70C,84C,86C 'check':7A,35B 'configur':76C 'control':78C 'cve':11A,14A 'exploit':74C 'function':38B 'gutenberg':22B,27B,64C,72C,85C 'higher':54B 'incorrect':75C 'issu':81C 'lack':31B 'leapworx':61C 'level':56B 'levels.this':80C 'may':41B 'miss':5A,57C 'n/a':90C 'packag':17B 'perform':45B 'plugin':4A,28B 'premium':2A,19B,25B,62C,69C,83C 'premium-blocks-for-gutenberg':18B,68C 'proper':33B 'restrict':50B 'secur':79C 'user':52B 'version':9A 'vulner':59C 'wordpress':1A,23B,30B,67C,88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Premium Blocks – Gutenberg Blocks for WordPress plugin at version 2.3.18 or earlier are affected. The flaw is an access control gap, so exposure depends on which accounts can reach the affected functionality. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","premiumblocksforgutenberg","wordpress"],"campaign_type":null,"search_a":"'-123474':13A,16A '-2026':12A,15A '2.3.18':10A 'author':6A 'block':3A 'check':7A 'cve':11A,14A 'miss':5A 'plugin':4A 'premium':2A 'version':9A 'wordpress':1A","search_b":"'abl':43B 'access':55B 'action':46B 'attack':40B 'author':34B 'block':20B,26B 'check':35B 'function':38B 'gutenberg':22B,27B 'higher':54B 'lack':31B 'level':56B 'may':41B 'packag':17B 'perform':45B 'plugin':28B 'premium':19B,25B 'premium-blocks-for-gutenberg':18B 'proper':33B 'restrict':50B 'user':52B 'wordpress':23B,30B","search_c":"'2.3.18':92C 'access':77C 'affect':82C 'allow':73C 'author':58C 'block':63C,65C,70C,84C,86C 'configur':76C 'control':78C 'exploit':74C 'gutenberg':64C,72C,85C 'incorrect':75C 'issu':81C 'leapworx':61C 'levels.this':80C 'miss':57C 'n/a':90C 'premium':62C,69C,83C 'premium-blocks-for-gutenberg':68C 'secur':79C 'vulner':59C 'wordpress':67C,88C","first_public_at":"2026-11-07T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123474","severity":null,"published_at":"2026-11-07T13:16:37+00:00","modified_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}