CVE-2026-17011: CWE-345 Insufficient Verification of Data Authenticity in Nexter Blocks
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
AI Analysis
Technical Summary
CVE-2026-17011 is a CWE-345 Insufficient Verification of Data Authenticity vulnerability in the Nexter Blocks WordPress plugin prior to version 5.0.2. It allows users with Contributor-level privileges to save arbitrary global CSS through a REST endpoint without proper restrictions. This CSS is applied site-wide on the front end, which can lead to visual defacement, hiding of content, and UI redressing attacks. The vulnerability has a CVSS 3.1 base score of 3.8, indicating low severity, with an attack vector over the network, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Potential Impact
Users with Contributor role privileges can inject arbitrary CSS that affects the entire site’s front-end appearance. This can result in defacement, hiding of legitimate content, and UI redressing, which may degrade user experience and trust. There is no direct confidentiality impact, but integrity and availability impacts are limited.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor role permissions or monitor and control access to REST endpoints that allow saving global CSS.
CVE-2026-17011: CWE-345 Insufficient Verification of Data Authenticity in Nexter Blocks
Description
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
CVSS v3.1
Score 3.8low
Affected software
Nexter Blocks
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17011 is a CWE-345 Insufficient Verification of Data Authenticity vulnerability in the Nexter Blocks WordPress plugin prior to version 5.0.2. It allows users with Contributor-level privileges to save arbitrary global CSS through a REST endpoint without proper restrictions. This CSS is applied site-wide on the front end, which can lead to visual defacement, hiding of content, and UI redressing attacks. The vulnerability has a CVSS 3.1 base score of 3.8, indicating low severity, with an attack vector over the network, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Potential Impact
Users with Contributor role privileges can inject arbitrary CSS that affects the entire site’s front-end appearance. This can result in defacement, hiding of legitimate content, and UI redressing, which may degrade user experience and trust. There is no direct confidentiality impact, but integrity and availability impacts are limited.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor role permissions or monitor and control access to REST endpoints that allow saving global CSS.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-24T10:10:03.572Z
- State
- PUBLISHED
Threat ID: 6a781a2ebf8831d5391ffee7
Added to database: 08/09/2026, 06:11:58 UTC
Last enriched: 08/16/2026, 14:35:21 UTC
Last updated: 09/22/2026, 01:52:42 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.