What the vulnerability does
01Description
The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0. This is due to insufficient authorization checks and missing server-side validation of the recipient email address supplied via a public REST API route. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient of their choosing through the affected WordPress site's mail server, effectively turning the site into an open mail relay.
Explanation of Vulnerability in Simple Terms
02Summary
Responsive Blocks contains an input validation flaw that allows unauthenticated attackers to modify data on the site. The vulnerability requires no user interaction and can be exploited over the network. An attacker can alter content or settings without authorization, though data confidentiality is not compromised.
What an attacker can do
03Attacker Capabilities
Modify or corrupt site data and settings without authentication.
Potential impact on your site
04Site Impact
Attackers can alter page content, block settings, or patterns without your permission or knowledge.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 21, 2026
CVE published
April 21, 2026
Record updated
