Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-11 | 4 | Disclosure4 |
| 2026-02-16 | 1 | Disclosure1 |
CVE-2026-1560 CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1560
Post summary
The post announces a newly disclosed Authenticated Remote Code Execution vulnerability in Lazy Blocks plugin (≤ 4.2.0) with a reference link, but lacks details on PoC, exploit code, active use, or patching.
CVE-2026-1560 (CVSS:8.8, HIGH) is Awaiting Analysis. The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to..https://nvd.nist.gov/vuln/detail/CVE-2026-1560 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
CVE-2026-1560 is identified as a high‑severity Remote Code Execution vulnerability affecting the Lazy Blocks plugin for WordPress, with no PoC, exploit, or patch details currently available; the issue is awaiting further analysis.
[CVE-2026-1560: HIGH] WordPress plugin Custom Block Builder – Lazy Blocks up to version 4.2.0 has a critical vulnerability allowing authenticated attackers to remotely execute code through certain functions.#cve,CVE-2026-1560,#cybersecurity https://cvefind.com/CVE-2026-1560
Post summary
The post announces a critical remote code execution vulnerability (CVE‑2026‑1560) in the Lazy Blocks WordPress plugin, noting that authenticated attackers can exploit it, but provides no PoC, exploit code, patch, or evidence of active exploitation.
🟠 CVE-2026-1560 - High The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Block... https://www.thehackerwire.com/vulnerability/CVE-2026-1560/ https://t.co/ucyx853bkG
Post summary
The Lazy Blocks WordPress plugin is vulnerable to Remote Code Execution (CVE‑2026‑1560), affecting all versions up to 4.2.0; the advisory highlights the issue but does not provide a PoC, exploit, or patch details.
🚨 High-severity RCE flaw in Lazy Blocks plugin affects all WordPress versions up to 4.2.0. Contributor+ users can execute code remotely — patch or restrict access now! 🔒 https://radar.offseq.com/threat/cve-2026-1560-cwe-94-improper-control-of-generatio-655d2091 #OffSeq #WordPr... https://t.co/rr9IfTi9CQ
Post summary
The tweet announces a high‑severity RCE vulnerability in the Lazy Blocks WordPress plugin for versions up to 4.2.0 and urges users to patch or restrict access.