CVE-2026-10096— Qode Interactive Qi Blocks 授权问题漏洞

Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved 'template' and 'widget' page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint's permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

通过用户控制密钥绕过授权机制

Qode Interactive Qi Blocks 授权问题漏洞

qodeinteractive qi blocks是qodeinteractive公司开源的一套WordPress块编辑器插件。 Qode Interactive Qi Blocks 1.4.9及之前版本存在授权问题漏洞，该漏洞源于对参数page_id验证缺失，导致不安全的直接对象引用，可能使经过身份验证的攻击者修改任意的帖子、模板或小部件的Qi Blocks样式，包括通过保留的template和widget参数值实现站点头面修改、内容隐藏或降级。

N/A

N/A