CVE-2026-1560

This repository contains a functional Python PoC for CVE-2026-1560, an authenticated RCE vulnerability in the Custom Block Builder – Lazy Blocks WordPress plugin (≤ 4.2.0). The exploit leverages a REST API endpoint that allows Contributor+ users to execute arbitrary PHP code via unsanitized block attributes.

This repository contains a functional proof-of-concept exploit for CVE-2026-1560, an authenticated remote code execution vulnerability in the Custom Block Builder – Lazy Blocks WordPress plugin (versions ≤ 4.2.0). The exploit leverages a REST API endpoint to execute arbitrary PHP code via an `eval()` sink, accessible to users with Contributor-level privileges.