CVE-2026-10096 describes an Insecure Direct Object Reference (IDOR) vulnerability in the Qi Blocks WordPress plugin affecting all versions up to and including 1.4.9. The issue stems from the 'page_id' parameter lacking proper validation, allowing authenticated users with author-level or higher privileges to modify stored styles of arbitrary posts, templates, or widgets regardless of ownership. The permission callback only verifies generic capabilities (edit_posts and publish_posts) without ownership checks, enabling unauthorized modification of site-wide elements such as templates and widgets. This can lead to frontend defacement, content hiding, or degradation of any page on the site.

The vulnerability allows authenticated users with author-level access or higher to alter the appearance and content presentation of posts, templates, or widgets they do not own. This can result in unauthorized frontend defacement, hiding of legitimate content, or degradation of site pages. There is no direct confidentiality or availability impact reported. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and limited privileges required but no confidentiality or availability impact.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and apply any future patches promptly. Until a fix is released, consider restricting author-level permissions or implementing additional access controls to limit modification capabilities. Review and harden permission callbacks to ensure ownership validation where possible.