The Vulnerable plugin fails to verify user authorization before processing AJAX actions. Any authenticated user with contributor role or higher can execute arbitrary configuration changes such as enabling or disabling custom CSS, turning off blocks, adjusting layout defaults, and manipulating auto‑block recovery. This flaw permits an attacker to modify core site settings, potentially leading to a degraded user experience or functional breakage. The weakness is a missing authorization check (CWE‑862).

The issue affects the WordPress plugin "Responsive Blocks – Page Builder for Blocks & Patterns" developed by cyberchimps. All releases up to and including version 2.2.1 are vulnerable; versions newer than 2.2.1 are presumed to have addressed the flaw.

With a CVSS score of 4.3 and an EPSS of less than 1%, the vulnerability has a moderate severity rating and a very low probability of exploitation in the wild. The flaw requires the attacker to be authenticated with contributor‑level access, so the attack vector is inferred to be execution of malicious AJAX requests after login. Although the risk of unmitigated exploitation is low, the impact on site configuration could be significant if an attacker gains valid credentials.