---
id: CVE-2026-75017
title: >-
  The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder,
  Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable
  to authorization bypass in all versions up to, and including, 1.8.6
summary: >-
  The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder,
  Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable
  to authorization bypass in all versions up to, and including, 1.8.6. This is
  due to t…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: wpblockart
product: >-
  Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page
  Builder with Posts Blocks, Post Grid
affected:
  - >-
    magazine_blocks_blog_designer_magazine_newspaper_website_builder_page_builder_with_posts_blocks_post_grid
    <= 1.8.6
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T15:17:11.677'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75017'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/magazine-blocks/tags/1.8.6/includes/MagazineBlocks.php#L98
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/magazine-blocks/tags/1.8.6/includes/PostTypes/SiteBuilder.php#L116
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/magazine-blocks/tags/1.8.6/includes/PostTypes/SiteBuilder.php#L138
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/magazine-blocks/tags/1.8.6/includes/PostTypes/SiteBuilder.php#L56
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3656574%40magazine-blocks&new=3656574%40magazine-blocks
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/7f66d26a-8eb7-4b29-bb7f-afdd762be4b2?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T14:15:52.728734Z'
epss: 0.00316
epssPercentile: 0.24737
ingestedAt: '2026-09-18T07:37:23.431Z'
---

## Overview

The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.