Executive brief
Cozy Blocks is a WordPress page builder plugin used by content creators and site administrators to design pages. The plugin fails to properly verify user permissions, allowing unauthenticated visitors to view sensitive information about draft, private, and hidden WooCommerce products—including pricing, descriptions, images, and stock levels—that should not be publicly visible. This exposes confidential product details and could impact business strategy or competitive advantage.
Technical details
This authorization bypass vulnerability exists in multiple block renderers within Cozy Blocks versions up to 2.2.17. The root cause is the unconditional emission of a valid sidebarNonce value into public page HTML without any login requirement, which allows unauthenticated attackers to harvest the nonce and use it to pass the only authentication check in the API handler. Attackers can then retrieve unauthorized metadata (name, price, short description, image URL, permalink, stock status, and product type) for WooCommerce products marked as draft, pending, private, or catalog-hidden. No user interaction is required; the nonce can be extracted passively from any public page. Patches should be available in versions after 2.2.17.
Affected products
- BracketSpace Cozy Blocks up to and including 2.2.17
Timeline
- 2026-09-01: disclosed