Authorization Bypass in CozyThemes Cozy Blocks Plugin for WordPress
CVE-2026-97070

6.9MEDIUM

Key Information:

Vendor

WordPress
Status
Cozy Blocks
Vendor
CVE Published:
5 October 2026

What is CVE-2026-97070?

A flaw has been identified in the CozyThemes Cozy Blocks plugin, which allows for an authorization bypass through user-controlled keys. This vulnerability can be exploited due to incorrectly configured access control security levels, potentially allowing unauthorized access to restricted functionalities. Users of Cozy Blocks versions up to 2.2.23 are advised to review their configuration and apply necessary updates to mitigate this security risk.

Affected Version(s)

Cozy Blocks 0 <= 2.2.23

References

https://patchstack.com/database/wordpress/plugin/cozy-add...
vdb-entry

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack)
.