CVE-2026-127048
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 15, 2026
Vendor
unknown
Description
The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.