CVE-2026-88824

Overview

The Master Blocks WordPress plugin before version 1.5.0 lacks proper authorization checks on a specific REST API route. This flaw allows unauthenticated remote attackers to modify plugin settings and inject arbitrary script code, resulting in Stored Cross-Site Scripting (XSS).

Description

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

Impact

Impact includes a compromise of Integrity and Availability for the affected WordPress site's administrative functions. Unauthenticated attackers can inject persistent malicious scripts that execute within the browser session of any privileged administrator visiting the wp-admin area, potentially leading to unauthorized administrative actions.

Remediation

Update the Master Blocks WordPress plugin to version 1.5.0 or later where the missing authorization check is resolved. Regularly audit installed plugins and restrict unauthenticated access to REST endpoints where applicable.

Risk context

Rated as critical with a CVSS v3 score of 8.8, representing a severe risk due to unauthenticated exploitability and high impact on administrative integrity. The current EPSS score is 0.0017, indicating low active exploitation observation in the wild at this time, but urgent patching is still recommended given the high severity.

Affected products

• Master Blocks WordPress plugin < 1.5.0