Is CVE-2026-75017 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75017 being exploited in the wild.

How severe is CVE-2026-75017?

Medium severity, with a CVSS score of 4.3, published 18 September 2026.

Which products and versions are affected?

Magazine Blocks Magazine Blocks up to and including 1.8.6.

Is there a fix for CVE-2026-75017?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75017 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75017?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75017: Magazine Blocks authorization bypass in builder templates

CVE-2026-75017 · Severity: medium · CVSS 4.3 · Published 2026-09-18

The Magazine Blocks WordPress plugin, used for creating magazine and newspaper websites with customizable layouts, is vulnerable to an authorization bypass that allows lower-privileged users to demote and modify administrator-controlled templates. Attackers with contributor-level access or higher can replace site-wide header, footer, and other key page templates with malicious content, leading to website defacement, phishing attacks, and SEO spam that impacts customer trust and search visibility.

Quick answers

Is CVE-2026-75017 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75017 being exploited in the wild.
How severe is CVE-2026-75017?: Medium severity, with a CVSS score of 4.3, published 18 September 2026.
Which products and versions are affected?: Magazine Blocks Magazine Blocks up to and including 1.8.6.
Is there a fix for CVE-2026-75017?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75017 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75017?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the mzb-builder-template post type registration. The plugin uses capability_type='post' for the custom post type and exposes it via the REST API without proper permission checks. The _mzb_template meta key is accessible to any user with the edit_posts capability (including Contributor-level and above), allowing these users to trigger the vulnerable save_post() hook and demote published administrator-owned templates to draft status. An authenticated attacker with contributor-level access or above can replace site-wide templates (header, footer, front page, single, archive, 404, and search) with attacker-authored content. A patch is available in versions after 1.8.6.

Affected products

Magazine Blocks Magazine Blocks up to and including 1.8.6

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.