{"id":"CVE-2026-127048","kind":"vulnerability","aliases":["CVE-2026-127048"],"related":[],"title":"Custom Block Builder WordPress plugin: unauthenticated REST requests run PHP code","description":"The Custom Block Builder  WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.","summary":"The Custom Block Builder WordPress plugin before 3.0.0 has REST routes whose permission checks return a non-error value that WordPress treats as granted. An unauthenticated visitor can therefore execute arbitrary PHP code on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Custom Block Builder","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["custom-block-builder","other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-3.0.0-or-later"],"how_to_check":"- Check the installed version of the Custom Block Builder plugin in the WordPress admin under Plugins, or in `wp-content/plugins/` for the plugin folder's version header.","fix":"- Custom Block Builder plugin: move to `3.0.0` or later (the sources state the fix as 'before 3.0.0').","status":"open","published_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:12+00:00","triaged_at":"2026-11-15T07:36:17+00:00","updated_at":"2026-11-15T07:36:17+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-15T07:36:17Z","model":"claude-haiku-5-5","output":{"fix":"- Custom Block Builder plugin: move to `3.0.0` or later (the sources state the fix as 'before 3.0.0').","reach":"internet","title":"Custom Block Builder WordPress plugin: unauthenticated REST requests run PHP code","impact":"high","summary":"The Custom Block Builder WordPress plugin before 3.0.0 has REST routes whose permission checks return a non-error value that WordPress treats as granted. An unauthenticated visitor can therefore execute arbitrary PHP code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","custom-block-builder","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker runs arbitrary PHP code on server","analyst_note":"Confirm the affected REST routes and whether the exploit is public; the NVD entry gives no severity score, so check the plugin's changelog or WPScan for details.","how_to_check":"- Check the installed version of the Custom Block Builder plugin in the WordPress admin under Plugins, or in `wp-content/plugins/` for the plugin folder's version header.\n- unknown for any further check; the sources do not say which REST route or setting is involved.","plain_action":"","product_name":"Custom Block Builder","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-3.0.0-or-later"],"who_is_affected":"Sites running the Custom Block Builder WordPress plugin older than 3.0.0 are exposed, since its REST routes accept unauthenticated requests. Sites without this plugin, or running 3.0.0 or later, are not affected by this description.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000775,"input_tokens":4544,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-127048':14A,17A '-2026':13A,16A '3.0.0':37B,74C 'allow':100C 'arbitrari':61B,105C 'block':2A,19A,23B,32B,69C 'builder':3A,20A,24B,33B,70C 'check':43B,88C 'code':11A,63B,107C 'custom':1A,18A,22B,31B,68C 'custom-block-build':21B 'cve':12A,15A 'deni':78C 'error':48B,93C 'execut':60B,104C 'grant':54B,99C 'host':28B 'non':47B,92C 'non-error':46B,91C 'permiss':42B,87C 'php':10A,62B,106C 'plugin':5A,35B,72C 'proper':77C 'request':8A,80C 'respons':94C 'rest':7A,39B,83C 'return':44B,89C 'rout':40B,84C 'run':9A 'self':27B 'self-host':26B 'server':66B,110C 'therefor':59B 'treat':52B,97C 'unauthent':6A,56B,101C 'unauthoris':79C 'user':102C 'valu':49B 'visitor':57B 'whose':41B 'wordpress':4A,29B,34B,51B,71C,96C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Custom Block Builder WordPress plugin older than 3.0.0 are exposed, since its REST routes accept unauthenticated requests. Sites without this plugin, or running 3.0.0 or later, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["blockbuilder","customblockbuilder"],"ptokens":["block","builder","custom"],"labels":["critical","customblockbuilder","other","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-127048':14A,17A '-2026':13A,16A 'block':2A,19A 'builder':3A,20A 'code':11A 'custom':1A,18A 'cve':12A,15A 'php':10A 'plugin':5A 'request':8A 'rest':7A 'run':9A 'unauthent':6A 'wordpress':4A","search_b":"'3.0.0':37B 'arbitrari':61B 'block':23B,32B 'builder':24B,33B 'check':43B 'code':63B 'custom':22B,31B 'custom-block-build':21B 'error':48B 'execut':60B 'grant':54B 'host':28B 'non':47B 'non-error':46B 'permiss':42B 'php':62B 'plugin':35B 'rest':39B 'return':44B 'rout':40B 'self':27B 'self-host':26B 'server':66B 'therefor':59B 'treat':52B 'unauthent':56B 'valu':49B 'visitor':57B 'whose':41B 'wordpress':29B,34B,51B","search_c":"'3.0.0':74C 'allow':100C 'arbitrari':105C 'block':69C 'builder':70C 'check':88C 'code':107C 'custom':68C 'deni':78C 'error':93C 'execut':104C 'grant':99C 'non':92C 'non-error':91C 'permiss':87C 'php':106C 'plugin':72C 'proper':77C 'request':80C 'respons':94C 'rest':83C 'return':89C 'rout':84C 'server':110C 'treat':97C 'unauthent':101C 'unauthoris':79C 'user':102C 'wordpress':71C,96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127048","severity":null,"published_at":"2026-11-15T07:16:54+00:00","modified_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:12+00:00","fetched_at":"2026-11-15T07:36:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}