Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter

Summary

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved 'template' and 'widget' page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint's permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.

Timeline

1. Jul 1, 2026, 7:53 AM UTCCVE published
2. Jul 1, 2026, 10:26 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jul 1, 2026, 10:32 AM UTCRecord last updated

Affected versions

• qodeinteractive Qi Blocks

  through 1.4.9

References 5