Junglewise Threat Intelligence

CVE-2026-10096: Qode Interactive Qi Blocks IDOR in page_id parameter

CVE-2026-10096 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Executive brief

The Qi Blocks plugin for WordPress, which provides custom design elements for websites, contains a security flaw that allows users with basic 'Author' permissions to modify content they do not own. An attacker could use this to change the appearance of any page, hide content, or deface the website's layout. This includes the ability to alter site-wide templates and widgets, potentially impacting the entire site's reputation and user experience.

Technical details

The Qi Blocks plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'page_id' parameter in the Global Styles component. The root cause is a lack of ownership validation on user-controlled keys within the plugin's REST API or AJAX endpoints. While the 'permission_callback' verifies that a user has 'edit_posts' and 'publish_posts' capabilities (standard for the Author role), it fails to check if the user has permission to edit the specific post, template, or widget identified by the 'page_id'. An authenticated attacker with Author-level access can exploit this to modify styles for arbitrary content, including site-wide elements using reserved identifiers like 'template' or 'widget'. This can lead to unauthorized frontend defacement and content manipulation. The issue is addressed in versions following 1.4.9.

Affected products

  • Qode Interactive Qi Blocks up to, and including, 1.4.9

Timeline

  • 2026-07-01: disclosed: Initial disclosure by Wordfence and NVD publication.

References