The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.
CVE-2026-127048
NONE
EPSS 0.17%
Updated Nov 15, 2026
WordPress
CVE Details
CVE ID
CVE-2026-127048
Published Date
Nov 15, 2026
Vendor
WordPress
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.17%
Likelihood of exploitation in next 30 days
Percentile:
6.8th percentile (higher than 6.8% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory