The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns for WordPress suffers from a missing authorization check (CWE-862) in the update_popup_status() function in all versions up to 2.3.11. This vulnerability allows unauthenticated attackers to change popup enablement settings, potentially impacting site behavior. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker without authentication can modify the popup status on affected WordPress sites using the vulnerable plugin, potentially altering site behavior or user experience. There is no direct confidentiality or availability impact reported. The integrity impact is low, limited to unauthorized modification of popup settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's update functions via web application firewall rules or other access controls to prevent unauthorized requests. Monitor for updates from bdthemes regarding a security patch.