CVE-2026-75017 is an authorization bypass vulnerability in the Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder plugin for WordPress, affecting all versions up to and including 1.8.6. The plugin fails to properly verify user authorization when modifying mzb-builder-template post types, which are registered with capability_type='post' and accessible via the REST API. As a result, authenticated users with contributor-level permissions or higher can demote administrator-owned published templates (such as header, footer, front page, single, archive, 404, and search templates) to draft status and replace them with attacker-authored block content. This enables site-wide defacement, phishing, and SEO spam attacks by leveraging the vulnerable save_post() hook triggered by users with edit_posts capability.

The vulnerability allows authenticated users with contributor-level access or higher to modify critical site templates owned by administrators. This can result in site-wide content defacement, phishing pages, or SEO spam insertion, impacting the integrity and trustworthiness of the affected websites. There is no direct confidentiality or availability impact reported. The CVSS score is 4.3 (medium severity), reflecting low complexity but limited scope of impact.

No official patch or fix is currently documented. Users should restrict contributor-level access and above to trusted users only until a fix is available. Monitor vendor advisories for updates. Since the plugin exposes sensitive post types via the REST API without proper authorization checks, consider disabling or restricting REST API access for these post types as a temporary mitigation if feasible.