CUSTOM BLOCK BUILDER · CVE-2026-127048 · Other
NO FIX YET · SEE WHAT TO DO
The Custom Block Builder WordPress plugin before 3.0.0 has REST routes whose permission checks return a non-error value that WordPress treats as granted. An unauthenticated visitor can therefore execute arbitrary PHP code on the server.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Custom Block Builder WordPress plugin older than 3.0.0 are exposed, since its REST routes accept unauthenticated requests. Sites without this plugin, or running 3.0.0 or later, are not affected by this description.
Not affected if plugin-not-installed, version-3.0.0-or-later
Who cares custom-block-builder, self-hosted, wordpress
wp-content/plugins/ for the plugin folder's version header.3.0.0 or later (the sources state the fix as 'before 3.0.0').The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.