The vulnerability in Cozy Themes’ Cozy Blocks plugin is a missing authorization flaw that allows an attacker to bypass normal access controls and interact with functions that should be reserved for higher‑privileged users. This can lead to unauthorized data manipulation, configuration changes, or other privileged actions, directly affecting the confidentiality, integrity, and availability of the WordPress site. The weakness is classified as CWE‑862, indicating an improper authorization issue.

The affected product is the Cozy Blocks plugin for WordPress, provided by CozyThemes. Versions up through 2.1.22 are vulnerable. The plugin is typically installed on any WordPress site that has added Cozy Blocks to its set of bits or blocs.

With a CVSS score of 5.3, the issue is of medium severity. The EPSS score is below 1%, indicating a low probability of exploitation at the current time, and it is not listed in the CISA KEV catalog. The likely attack vector involves a remote attacker using the web interface of a WordPress site, leveraging a user account or possibly an unauthenticated session to reach the missing authorization checks. Exploitation requires the attacker to identify a permitted function that is incorrectly accessible to lower‑privileged users.