What the vulnerability does
01Description
The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global site-wide plugin configuration options, including toggling custom CSS, disabling blocks, changing layout defaults such as content width, container padding, and container gap, and altering auto-block-recovery behavior.
Explanation of Vulnerability in Simple Terms
02Summary
Responsive Blocks – Page Builder for Blocks & Patterns versions 2.0.9 through 2.2.1 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with low-level site access can alter data without the appropriate permissions. Update to a version newer than 2.2.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify site content or settings without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter pages, blocks, or patterns they shouldn't be able to edit.
Conditions required to exploit
05Prerequisites
Attacker must have a low-level authenticated account on the site.
Key dates
06Disclosure timeline
April 21, 2026
CVE published
April 21, 2026
Record updated
