The Qi Blocks plugin for WordPress contains a missing capability check on the resize_image_callback function. This flaw allows an authenticated attacker with Contributor level or higher to target any media library attachment and request that it be resized. The server then creates a new image file and processes the image, which can result in unintended file writes and consume significant disk space or CPU resources, potentially leading to a denial‑of‑service condition.

All WordPress sites that have the Qi Blocks plugin from Qode Interactive installed and running version 1.4.3 or earlier are affected. The vulnerability is present in every deployment of those versions and can be exploited by any user account that holds Contributor or higher privileges.

The CVSS score of 4.3 indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only valid credentials with Contributor or higher level to trigger the resize operation, after which no further checks are performed. While the likelihood is low, the potential for resource exhaustion warrants timely remediation.