Executive brief
The Master Blocks WordPress plugin allows unauthenticated users to modify plugin settings through an unprotected REST API endpoint. An attacker can inject malicious JavaScript into these settings, which then executes in the browser of any administrator viewing WordPress admin pages, enabling account hijacking, malware deployment, or data theft from administrative sessions.
Technical details
The plugin fails to implement authorization checks on a REST route responsible for updating settings. An unauthenticated attacker can POST malicious payloads to this endpoint; the injected value is stored in the database and later output without HTML escaping in wp-admin pages. When an authenticated administrator visits the admin area, the unescaped JavaScript executes in their session context.
Affected products
- Master Blocks Master Blocks before 1.5.0
Timeline
- 2026-09-17: disclosed
- 2026-09-19: patched: Fixed in version 1.5.0