CVE-2026-97070— WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability
Quick assessment
Affected
CozyThemes Cozy Blocks
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 CozyThemes 的 Cozy Blocks cozy-addons 中存在“通过用户控制的键绕过授权”漏洞，该漏洞可导致错误配置的访问控制安全级别被利用。此问题影响 Cozy Blocks：从 n/a 到 2.2.23 版本。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access TokenAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| CozyThemes | Cozy Blocks | ≤ 2.2.23 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97070
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| CozyThemes | Cozy Blocks | 0 ~ 2.2.23 | - |
|
II. Public POCs for CVE-2026-97070
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97070
请登录查看更多情报信息。
Other References for CVE-2026-97070 (1)
IV. Related Vulnerabilities
Same product: Cozy Blocks
-
CVE-2025-59573
WordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection V -
CVE-2025-47485
WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Contr -
CVE-2025-30838
WordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting -
CVE-2024-50441
WordPress Cozy Blocks plugin <= 2.0.15 - Cross Site Scriptin -
CVE-2024-50502
WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scriptin
Same vendor: CozyThemes
-
CVE-2026-19948
Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthentic -
CVE-2026-75019
Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored -
CVE-2026-15950
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored -
CVE-2026-15393
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored -
CVE-2026-15334
Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored
Same weakness: CWE-639
-
CVE-2026-97305
WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0 -
CVE-2026-105637
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEn -
CVE-2026-105633
Plane: Issue Attachment Ownership Hijacking via Missing `iss -
CVE-2026-105631
Plane: asset download endpoints scope file lookups to the wo -
CVE-2026-105629
Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletio
V. Comments for CVE-2026-97070
No comments yet