CVE-2026-123474
MediumCVSS 5.3Summary
The Premium Blocks – Gutenberg Blocks for WordPress plugin (through version 2.3.18) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could perform unauthorized actions within the plugin, potentially modifying content or accessing functionality restricted to authorized users.
Recommendation
Update the Premium Blocks plugin to a version newer than 2.3.18 and review WordPress role permissions.
Other vulnerabilities in Premium Blocks – Gutenberg Blocks for WordPress
See all- CVE-2026-123466Medium
The Premium Blocks – Gutenberg Blocks for WordPress plugin (up to version 2.3.18) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-94118Medium
Cross Site Scripting (XSS) vulnerability in the Premium Blocks – Gutenberg Blocks for WordPress plugin in versions up to and including 2.3.17. The vulnerability can be exploited by a user with Contributor privileges.
Original NVD description (English source)
Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS