CVE-2026-97070: WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Cozy Blocks pluginto a version that resolves this vulnerability.Fixed in 2.2.24
Event History
Frequently Asked Questions
Which installations are affected?
Cozy Blocks versions through 2.2.23 are affected. The provided data does not identify a lower affected version, so the affected range is listed as from n/a through 2.2.23.
What access does an attacker need to exploit this issue?
The vulnerability is described as an authorization bypass through a user-controlled key and incorrectly configured access-control levels. The provided data does not state whether authentication, a particular WordPress role, or any other prerequisite is required.
How can I determine whether my site is affected?
Check whether the CozyThemes Cozy Blocks plugin is installed and identify its version. Installations running version 2.2.23 or an earlier version within the listed affected range should be treated as affected.