CVE-2026-107249

Name of the Vulnerable Software and Affected Versions Block AJAX versions 0.0.0 through 3.0.2

Description Improperly controlled modification of dynamically-determined object attributes in the Block AJAX module allows for Object Injection. The module fails to sufficiently validate user-supplied data used to construct a block, which can lead to PHP Object Injection and Remote Code Execution. This issue specifically affects sites that have Layout Builder enabled or other block plugins that handle the data passed by this module in an unsafe manner.

Recommendations Update Block AJAX to a version newer than 3.0.2.