Custom Blocks Constructor – Lazy Blocks, CVE-2026-1560

CVE, Research URL: CVE-2026-1560
Home page URL: Security reports for Custom Blocks Constructor – Lazy Blocks
Application: Custom Blocks Constructor – Lazy Blocks
Published on: Feb 11, 2026
Research Description: The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Affected versions: max 4.2.1.
Status: vulnerable

Custom Blocks Constructor &#8211; Lazy Blocks, CVE-2026-1560