Custom Block Builder – Lazy Blocks <= 4.2.0 - 認証済み (コントリビューター以上) リモートコード実行
プラットフォーム
wordpress
コンポーネント
lazy-blocks
修正版
4.2.1
CVE-2026-1560 is a Remote Code Execution (RCE) vulnerability affecting the Custom Block Builder – Lazy Blocks plugin for WordPress. This vulnerability allows authenticated attackers, possessing Contributor-level access or higher, to execute arbitrary code on the server. The vulnerability impacts versions 0.0.0 through 4.2.0, and a patch is available in version 4.2.1.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
The impact of this vulnerability is significant due to the potential for remote code execution. An attacker with Contributor access can leverage this flaw to gain complete control over the WordPress server, potentially leading to data breaches, website defacement, malware installation, and further compromise of the network. The attacker could exfiltrate sensitive data, modify website content, or use the server as a launchpad for attacks against other systems. This vulnerability shares similarities with other WordPress plugin vulnerabilities where insufficient input validation allows for code injection.
悪用の状況翻訳中…
CVE-2026-1560 was publicly disclosed on 2026-02-11. The vulnerability’s ease of exploitation, combined with the prevalence of WordPress, suggests a moderate exploitation probability. No public proof-of-concept (POC) code has been released at the time of writing, but the vulnerability's nature makes it likely that one will emerge. It is not currently listed on the CISA KEV catalog.
リスク対象者翻訳中…
WordPress websites utilizing the Custom Block Builder – Lazy Blocks plugin, particularly those with multiple contributors or users with elevated privileges, are at significant risk. Shared hosting environments where plugin updates are not consistently managed are also particularly vulnerable.
検出手順翻訳中…
• wordpress / composer / npm:
grep -r 'LazyBlocks_Blocks' /var/www/html/wp-content/plugins/• wordpress / composer / npm:
wp plugin list --status=inactive | grep 'Custom Block Builder – Lazy Blocks'• wordpress / composer / npm:
wp plugin list --status=active | grep 'Custom Block Builder – Lazy Blocks' && wp plugin version 'Custom Block Builder – Lazy Blocks'攻撃タイムライン
- Disclosure
disclosure
脅威インテリジェンス
エクスプロイト状況
EPSS
0.13% (32% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- 低 — 有効なユーザーアカウントがあれば十分。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- 高 — 機密性の完全喪失。全データが読み取り可能。
- Integrity
- 高 — 任意のデータの書き込み・変更・削除が可能。
- Availability
- 高 — 完全なクラッシュまたはリソース枯渇。完全なサービス拒否。
影響を受けるソフトウェア
パッケージ情報
- アクティブインストール数
- 20Kニッチ
- プラグイン評価
- 4.9
- WordPressが必要
- 6.2+
- 動作確認済みバージョン
- 7.0
- PHPが必要
- 8.0+
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation is to immediately upgrade the Custom Block Builder – Lazy Blocks plugin to version 4.2.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These include implementing strict Web Application Firewall (WAF) rules to filter potentially malicious requests targeting the vulnerable functions within the 'LazyBlocks_Blocks' class. Thorough code review of the plugin's codebase can also help identify and block suspicious patterns. After upgrading, confirm the fix by attempting to trigger the vulnerable code paths and verifying that they are now properly sanitized.
修正方法
バージョン4.2.1、またはそれ以降の修正バージョンにアップデートしてください
CVEセキュリティニュースレター
脆弱性分析と重要アラートをメールでお届けします。
よくある質問翻訳中…
What is CVE-2026-1560 — RCE in Custom Block Builder – Lazy Blocks?
CVE-2026-1560 is a Remote Code Execution vulnerability affecting the Custom Block Builder – Lazy Blocks WordPress plugin, allowing authenticated attackers to execute code on the server.
Am I affected by CVE-2026-1560 in Custom Block Builder – Lazy Blocks?
You are affected if you are using Custom Block Builder – Lazy Blocks versions 0.0.0 through 4.2.0. Upgrade immediately.
How do I fix CVE-2026-1560 in Custom Block Builder – Lazy Blocks?
Upgrade the plugin to version 4.2.1 or later. As a temporary measure, implement WAF rules and code review.
Is CVE-2026-1560 being actively exploited?
While no active exploitation has been confirmed, the vulnerability's nature makes it likely that exploitation attempts will occur.
Where can I find the official Custom Block Builder advisory for CVE-2026-1560?
Refer to the plugin developer's website or WordPress plugin repository for the latest advisory and update information.