The Responsive Blocks – Page Builder for Blocks & Patterns plugin is vulnerable to an unauthenticated open email relay because the REST API route handling the email_to parameter lacks proper authentication checks and server‑side validation. An attacker can craft a request to this endpoint and supply any email address, causing the site to send emails on behalf of the server. This permits spammers or malicious actors to use the site’s mail server to send arbitrary emails, potentially resulting in reputational damage, blacklisting, and phishing or spam campaigns. The weakness is a classic input validation and authorization flaw (CWE‑20).

All installations of the Cyberchimps Responsive Blocks – Page Builder for Blocks & Patterns WordPress plugin version 2.2.0 or earlier are affected. The vulnerability applies to any WordPress site that has not upgraded beyond this version.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is unauthenticated; an attacker only needs to send a crafted HTTP request to the public REST endpoint with an email_to parameter. Successful exploitation is straightforward once the endpoint is reachable, but it does not provide remote code execution or other capabilities beyond email relay.