CVE-2026-1560 is a remote code execution vulnerability in the Custom Block Builder – Lazy Blocks WordPress plugin affecting all versions up to and including 4.2.0. The issue arises from multiple functions within the 'LazyBlocks_Blocks' class that improperly control the generation of code, allowing authenticated attackers with Contributor-level privileges or higher to execute arbitrary code on the server. This vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with Contributor-level access or above to execute arbitrary code on the affected server, potentially leading to full system compromise, data loss, or service disruption. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.