Unauthenticated Open Email Relay Vulnerability in Responsive Blocks – Page Builder for Blocks & Patterns Plugin from WordPress

CVE-2026-6675

What is CVE-2026-6675?

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to an unauthenticated open email relay issue, which affects all versions up to and including 2.2.0. The vulnerability arises from inadequate authorization checks and a lack of validation for the recipient's email address supplied through a public REST API route. As a result, attackers without authentication can exploit the flaw to send arbitrary emails, potentially leading to spam abuse and reputational damage for affected websites. This vulnerability underscores the importance of implementing strict validation and authorization mechanisms to safeguard against unauthorized email transmission.

References