The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to remote code execution within the ‘LazyBlocks_Blocks’ class. The flaw allows an authenticated user with Contributor-level permissions or higher to execute arbitrary code on the server. This results in full compromise of the installation, permitting attackers to gain any privileges the site’s user accounts possess, leading to possible data theft, site defacement, or further lateral movement.

WordPress sites running the Custom Block Builder – Lazy Blocks plugin in any version up to and including 4.2.0 are affected. Users should verify the installed plugin version and determine if it falls within the vulnerable range.

The vulnerability carries a CVSS score of 8.8, indicating a high severity consequence. The EPSS score is currently below 1%, which suggests a low probability of active exploitation at this time. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector requires authenticated access; therefore, an attacker must first obtain Contributor or higher level privileges on the target WordPress site to exploit the flaw. Once authenticated, the attacker can trigger the vulnerable functions and execute arbitrary code on the server.