Description

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T05:17:09.617Z",
  "pubdate": "2026-09-01T05:17:09.617Z",
  "executiveSummary": "The Cozy Blocks – Page Builder for Gutenberg Editor & FSE plugin (versions up to and including 2.2.17) contains a critical authorization bypass vulnerability.\nThe flaw allows unauthenticated remote attackers to gain unauthorized access to sensitive WooCommerce product data, including metadata for draft, pending, private, and catalog-hidden items.\nThe vulnerability stems from inadequate access control implementation and the insecure exposure of a sensitive security token (nonce) within the public-facing HTML source code.\nAttackers can leverage this exposed nonce to bypass the plugin's authentication checks, effectively granting them permission to query restricted product information.\nThe impact includes unauthorized information disclosure, potentially compromising business intelligence, pricing strategies, and draft content strategies.\nGiven that no authentication is required to harvest the necessary nonce or initiate the exploit, the risk level is high. The exposure of internal metadata can lead to significant privacy and competitive intelligence leaks for affected WooCommerce-enabled WordPress environments.",
  "technicalDetails": "The vulnerability is rooted in the improper implementation of authorization checks within the plugin's REST API or AJAX action handlers. The Cozy Blocks plugin renders specific Gutenberg blocks that serve as the primary attack surface.\nThe core issue is twofold: first, the plugin injects a 'sidebarNonce' directly into the public-facing HTML document across multiple block renderers without verifying the user's session or authorization level. This renders the nonce publicly accessible to any unauthenticated visitor who views the page source.\nSecond, the backend request handler responsible for processing product data queries relies solely on the verification of this 'sidebarNonce' to authorize the request. It fails to implement a subsequent check against the user's capabilities (e.g., 'edit_posts' or specific WooCommerce management permissions).\nThe attack flow follows a predictable pattern: 1) The attacker accesses any public page on the WordPress site that utilizes a vulnerable Cozy Blocks block. 2) The attacker parses the HTML source code to extract the 'sidebarNonce' value emitted by the plugin. 3) The attacker constructs a malicious request to the vulnerable endpoint, appending the harvested nonce in the expected field. 4) The server-side code validates the nonce as authentic, assumes the request is authorized, and executes the backend logic to retrieve WooCommerce product information. 5) The response returns structured data such as product names, prices, short descriptions, image URLs, permalinks, stock statuses, and product types for items that are currently in draft, pending, private, or catalog-hidden states.\nBecause the 'sidebarNonce' is emitted unconditionally, there is no requirement for session persistence or elevated privileges. The exploit can be automated, allowing for large-scale harvesting of sensitive store information. This bypass effectively turns a restricted administrative query into a publicly accessible resource, circumventing the expected WordPress REST API security architecture. The affected component is the block rendering mechanism of the plugin, which acts as the entry point for the information disclosure. Versions 2.2.17 and earlier are confirmed as vulnerable, as they lack the necessary context-aware validation required to restrict access based on the authentication status of the requester."
}