CVE-2026-1560

Name of the Vulnerable Software and Affected Versions Custom Block Builder – Lazy Blocks versions prior to 4.2.1

Description The Custom Block Builder – Lazy Blocks plugin for WordPress has a flaw that allows for Remote Code Execution. An authenticated attacker with Contributor-level access or higher can execute code on the server through multiple functions within the LazyBlocks Blocks class.

Recommendations Update the Custom Block Builder – Lazy Blocks plugin to version 4.2.1 or later.