CVE-2026-2028 is an authorization bypass vulnerability in the MaxiBlocks Builder WordPress plugin, affecting all versions up to 2.1.8. The flaw arises from insufficient file ownership validation in the 'maxi_remove_custom_image_size' AJAX action, enabling authenticated users with Author-level privileges or higher to delete arbitrary files within the wp-content/uploads directory, including files owned by other users and administrators. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low attack complexity, and no required user interaction. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with Author-level or higher access can delete arbitrary media files in the WordPress uploads directory, potentially disrupting website content or removing critical media assets. The vulnerability does not disclose sensitive information or cause denial of service but allows unauthorized modification of files, impacting integrity. Since the attacker must be authenticated with at least Author privileges, the risk is limited to compromised or malicious user accounts with such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious activity related to media file deletions. Consider implementing additional access controls or file integrity monitoring to detect unauthorized deletions. Avoid granting Author or higher privileges to untrusted users.