The WPScan CNA record identifies versions before 3.0.0 as affected. Its description says a faulty permission check on plugin REST routes can let an unauthenticated user execute arbitrary PHP code on the server.WPScan published its vulnerability entry on 13 November 2026, and the CVE record followed on 15 November. WordPress.org dates version 3.0.0 to 9 November 2022. The new CVE identifier therefore does not mean a new patch was released in 2026.
What it allows
How Does CVE-2026-127048 Enable Code Execution?
The CNA says the plugin's REST route permission checks return a non-error response for unauthorized requests. WordPress treats that response as permission granted. An unauthenticated user can then reach plugin functionality that executes arbitrary PHP code on the server.
This is the CNA's described mechanism, not a claim that every installation was attacked. The remote code execution explainer describes the impact of server-side code execution. We omit route names and request details because they are unnecessary for defensive triage.
What Does the Current Risk Evidence Mean?
WPScan assigns the flaw a 9.8 Critical score, but its public entry does not identify a CVSS version or vector. Brandefense Blackhole counted two dark-chat posts mentioning this CVE from 17 August through 15 November 2026. The measured unit is posts, not affected sites or confirmed exploitation.
The CISA KEV catalog snapshot dated 13 November 2026 does not list this CVE; it predates the CVE record. Neither the mention count nor that catalog snapshot determines whether exploitation occurred. Review any old exposed installation on its own evidence, including access and system-change records.
Who is affected
Which Lazy Blocks Versions Are Affected by CVE-2026-127048?
WPScan identifies Lazy Blocks versions before 3.0.0 as affected and names 3.0.0 as fixed. The CNA record calls the product Custom Block Builder; WordPress.org lists the plugin as Lazy Blocks, with Custom Block Builder in its title. Check the installed plugin version under that name or its lazy-blocks slug.
WordPress.org lists version 4.5.1 and more than 20,000 active installations on 15 November 2026. That installation count covers all versions and cannot be used as a vulnerable-installation estimate. Its changelog dates 3.0.0 to 9 November 2022 and notes a REST permission-check correction.
Prioritize installations still running a version below 3.0.0, especially those reachable from untrusted networks. Update to a currently supported release, then verify the running plugin version is at least 3.0.0. Record that verification in your patch management process and track affected assets through a vulnerability intelligence platform.
Timeline
- 2022-11-09
WordPress.org lists Lazy Blocks 3.0.0, the version WPScan identifies as fixed.
- 2026-11-13
WPScan publicly published its vulnerability entry.
- 2026-11-15
WPScan published the CVE-2026-127048 CNA record.
What to do
-
Find old Lazy Blocks installations
Inventory WordPress sites with the lazy-blocks plugin. Record the running plugin version and whether each site is reachable from untrusted networks.
-
Upgrade and verify the version
Update every installation below 3.0.0 to a currently supported release. After rollout, verify that the active Lazy Blocks version is at least 3.0.0.
-
Investigate suspicious legacy sites
For previously exposed installations below 3.0.0, review relevant access logs and unexpected server-side changes. Treat this as a defensive investigation, not proof that the CVE was exploited.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Does CVE-2026-127048 affect current Lazy Blocks releases?
WPScan lists versions before 3.0.0 as affected and 3.0.0 as fixed. Verify the active plugin version on each WordPress site.
Was a new Lazy Blocks patch released in November 2026?
The CVE was published in November 2026, but WordPress.org dates the fixed 3.0.0 release to 9 November 2022.
Do 20,000 active installations mean 20,000 vulnerable sites?
No. WordPress.org reports active installations across all Lazy Blocks versions. The public count does not identify how many sites still run a version below 3.0.0.
Is exploitation of CVE-2026-127048 confirmed?
Brandefense Blackhole counted two dark-chat posts mentioning this CVE from 17 August through 15 November 2026. These posts are discussion signals and do not verify exploitation.
Sources
- Lazy Blocks before 3.0.0 Unauthenticated RCEWPScan
- CVE-2026-127048 RecordWPScan CNA via CVE Program
- Custom Block Builder – Lazy BlocksWordPress.org
- Known Exploited Vulnerabilities CatalogCISA
