CozyThemes Cozy Blocks plugin contains an IDOR flaw that allows an attacker to manipulate a request parameter in order to bypass authorization controls and view or modify content that should be restricted to higher‑privileged users. The flaw stems from improper verification of user‑controlled keys, a classic CWE-639 violation that can enable unauthorized data tampering or content injection.

WordPress sites that have Cozy Blocks installed at any version up to and including 2.2.23 are impacted. All installations using Cozy Blocks 2.2.23 or earlier are susceptible, regardless of the specific WordPress theme or version.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV, so the precise likelihood of exploitation cannot be quantified. Exploitation is likely achievable through crafted URLs or API calls that alter the ‘key’ or block identifier parameter, thereby granting access to resources that should not be reachable by the attacker.