WordPress Master Blocks Plugin Unauthenticated REST API Settings Update

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Master Blocks WordPress plugin before version 1.5.0 contains a critical authorization bypass vulnerability in its REST API endpoints. An unauthenticated attacker can modify plugin settings without any permission checks, and crucially, one of these settings is rendered unescaped in the WordPress admin dashboard. This creates a Stored Cross-Site Scripting (XSS) vulnerability that executes arbitrary JavaScript in the browser context of any administrator who accesses wp-admin pages. WordPress site owners using vulnerable versions face significant risk, as attackers can inject malicious scripts that steal admin credentials, create new admin accounts, or perform administrative actions on behalf of compromised administrators. The vulnerability chain—missing authorization → arbitrary data input → unescaped output—represents a common but highly dangerous pattern in web application security.

Casky's skill library maps this attack across two critical MITRE ATT&CK techniques: TA0001 (Initial Access) for the unauthenticated REST endpoint exploitation, and TA0043 (Reconnaissance) for the reconnaissance phase where attackers probe for vulnerable plugin versions. A practitioner using Casky would receive findings highlighting unauthorized REST route access patterns, detection of stored XSS payloads in WordPress option tables, and anomalous wp-admin page rendering with injected script elements. The platform's 323 matching security skills leverage Claude's extended reasoning to correlate multiple indicators: REST API calls without authentication tokens, settings modifications from unexpected sources, HTML/JavaScript entities in option values that bypass WordPress sanitization functions, and admin session activity following suspicious configuration changes. This multi-layered detection approach helps practitioners identify both the initial exploitation attempt and the dormant XSS payload before it executes in admin browsers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-88824.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-88824

Casky has 323 skills that investigate the attack patterns behind CVE-2026-88824. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn