PT-2026-34842

CVE-2026-2028

Published

2026-04-23

Updated

2026-04-25

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MaxiBlocks Builder versions prior to 2.1.9

Description Insufficient file ownership validation in the 'maxi remove custom image size' AJAX action allows authenticated attackers with Author-level access or higher to delete arbitrary media files within the wp-content/uploads directory. This includes files uploaded by other users and administrators.

Recommendations Update to a version newer than 2.1.8.

Exploitability

Exploit

Fix

Impacts

Researchers

Teerachai Somprasong

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers