CVE-2026-1560: Nko Custom Block Builder – Lazy Blocks

High severity, CVSS 8.8. EPSS: 9.4% chance of exploitation in the next 30 days.

The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affected products

• Nko Custom Block Builder – Lazy Blocks: up to and including 4.2.0

Published 2026-02-11. Last modified 2026-06-17.