CVE-2026-2028mediumCWE-639

CVE-2026-2028: medium-severity vulnerability in ckp267 MaxiBlocks Builder | 17,000+ Design…

Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter

Published

Follow this CVE+ Monitor MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_custom_image_size' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files in the wp-content/uploads directory, including files uploaded by other users and administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
ckp267 · MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites
Related CVEs — ckp267 MaxiBlocks Builder | 17,000+ Design…

In the same product, most dangerous first.

CVE-2024-6885HIGHMaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 1.1%CVE-2026-6378MEDIUMMaxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST APIEPSS 0.2%