A critical remote code execution vulnerability in the Lazy Blocks WordPress plugin allows authenticated attackers to compromise the underlying server.

The vulnerability exists due to improper control of code generation (CWE-94) within multiple functions of the LazyBlocks_Blocks class. It permits an authenticated attacker with at least Contributor-level privileges to inject and execute code on the host server.

The ability to achieve remote code execution poses a severe threat to business operations, as it grants attackers full control over the web server environment. With a CVSS score of 8.8, this vulnerability carries a high risk of total system compromise, including unauthorized data exfiltration, modification of site content, and potential lateral movement into the wider internal network.

Immediate Action: Update the Lazy Blocks plugin to the latest version, which includes the necessary security patches to remediate the code injection flaw.

Proactive Monitoring: Review WordPress user roles and capabilities to ensure that unauthorized accounts do not possess Contributor-level access, and monitor server logs for suspicious process execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious REST API requests directed at the vulnerable class methods.

Public Exploit Available: No (exploit_available unknown)

Given the potential for remote code execution, this vulnerability represents an urgent security risk to any environment utilizing the Lazy Blocks plugin. Administrators must prioritize updating this component immediately to prevent unauthorized server access. If an update cannot be applied promptly, the plugin should be disabled or restricted to prevent exploitation of the identified code injection vector.