CVE-2026-19948 Missing authorization in Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
Unauthenticated attackers can retrieve unpublished WooCommerce product details by exploiting missing authorization checks in the Cozy Blocks plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19948?
CVE-2026-19948 is a medium-severity missing authorization vulnerability in cozythemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.
Weakness: CWE-862
Which versions are affected by CVE-2026-19948?
How do I fix CVE-2026-19948?
No fix has been published for CVE-2026-19948 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-19948 being exploited?
There is no known exploitation of CVE-2026-19948 in the wild and no public exploit code.
Sources
Also known as GHSA-5mfr-rhq6-hr3v.