Responsive Blocks <= 2.2.0 - Unauthenticated Open Email Relay via REST API 'email_to' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0. This is due to insufficient authorization checks and missing server-side validation of the recipient email address supplied via a public REST API route. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient of their choosing through the affected WordPress site's mail server, effectively turning the site into an open mail relay.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CyberChimps | Responsive Blocks – Page Builder for Blocks & Patterns | up to 2.2.0 | — | No fix listed | CNA |
- Responsive Blocks – Page Builder for Blocks & Patterns VendorCyberChimps Affected up to 2.2.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6675
- 2026-10-03 Alias added: GHSA-jqqm-hx2h-83c5
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/17452a29-bcef-451a-9893-a436ac5d3b80?source=cve
- https://plugins.trac.wordpress.org/browser/responsive-block-editor-addons/trunk/includes/class-responsive-block-editor-addons.php#L2403
- https://plugins.trac.wordpress.org/browser/responsive-block-editor-addons/tags/2.1.9/includes/class-responsive-block-editor-addons.php#L2403
- https://plugins.trac.wordpress.org/browser/responsive-block-editor-addons/trunk/includes/class-responsive-block-editor-addons.php#L2212
- https://plugins.trac.wordpress.org/browser/responsive-block-editor-addons/tags/2.1.9/includes/class-responsive-block-editor-addons.php#L2212
- https://plugins.trac.wordpress.org/browser/responsive-block-editor-addons/trunk/includes/class-responsive-block-editor-addons.php#L2324
- https://plugins.trac.wordpress.org/browser/responsive-block-editor-addons/tags/2.1.9/includes/class-responsive-block-editor-addons.php#L2324
More CyberChimps vulnerabilities
- TI-2024-12395 Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <=… CVSS 3.1HIGH 8.8
- TI-2020-09724 The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for… CVSS 3.1HIGH 8.8
- TI-2024-02658 Responsive <= 5.0.2 - Missing Authorization to HTML Injection CVSS 3.1HIGH 7.5
- TI-2026-25071 WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.3
- TI-2025-26320 WordPress Responsive Blocks plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2024-35030 WordPress Responsive Addons for Elementor plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-6675 · CVE Program
- CVE-2026-6675 · NVD
- FIRST EPSS
- GHSA-jqqm-hx2h-83c5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences