Description

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-19T07:16:33.273Z",
  "pubdate": "2026-09-19T07:16:33.273Z",
  "executiveSummary": "The Master Blocks WordPress plugin, specifically in versions prior to 1.5.0, contains a critical security vulnerability involving the absence of authorization checks on a REST API endpoint.\nThis flaw allows unauthenticated remote attackers to modify plugin settings arbitrarily.\nA specific configuration value within these settings is rendered in the WordPress administrative dashboard without adequate sanitization or output escaping.\nThe vulnerability manifests as a Stored Cross-Site Scripting (XSS) attack. When an administrator navigates to the affected wp-admin page, the malicious script executes within their authenticated session.\nSuccessful exploitation grants an attacker the ability to execute arbitrary JavaScript in the context of the administrator's browser session, potentially leading to unauthorized administrative actions, account takeover, or session hijacking.\nThe risk is categorized as high, as it requires no prior authentication and targets the most privileged users of the WordPress installation.",
  "technicalDetails": "The vulnerability originates from an insecure implementation of the WordPress REST API within the Master Blocks plugin. The plugin registers a custom REST route that fails to implement appropriate permission callbacks (e.g., 'permission_callback' => '__return_true' or missing capability checks), thereby allowing any unauthenticated user to invoke the endpoint.\nThe attack flow begins when an unauthenticated attacker sends a crafted POST request to the plugin's REST route. This request includes parameters designed to update the plugin's internal settings database.\nOne of these settings fields is stored globally and subsequently rendered in the administrative interface. The plugin fails to perform input validation or output encoding on this field, violating the principle of 'never trust user input' and failing to utilize WordPress security functions such as esc_html(), esc_attr(), or sanitize_text_field().\nBecause the payload is saved directly to the database, it persists across page loads. When an administrator accesses the wp-admin area where the malicious configuration value is output, the browser interprets the injected payload as active content rather than plain text.\nThe resulting Stored XSS executes within the security context of the administrator's session. This allows the payload to perform actions on behalf of the administrator, such as creating new rogue administrative accounts, modifying plugin or theme files (if permissions allow), or exfiltrating sensitive session cookies via document.cookie if the HttpOnly flag is not properly configured.\nThe impact is significant because it provides an unauthenticated actor the capability to perform actions that are strictly reserved for administrative users, effectively escalating privileges through the compromise of an administrator's browser-based session."
}