What the vulnerability does
01Description
The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary CSS, which can be used to perform actions such as hiding content, overlaying fake UI elements, or exfiltrating sensitive information via CSS injection techniques.
Explanation of Vulnerability in Simple Terms
02Summary
Qi Blocks versions 1.4.3 and earlier lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can change data through the application without proper permission validation. The vulnerability affects integrity but not confidentiality or availability.
What an attacker can do
03Attacker Capabilities
Modify content or settings they should not have permission to change.
Potential impact on your site
04Site Impact
Unauthorized users can alter site content, data, or configuration within their account level.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
November 1, 2025
CVE published
April 8, 2026
Record updated
