CVE-2026-2028: 
WordPress vulnerability analysis and mitigation

CVE-2026-2028 is an arbitrary media file deletion vulnerability in the MaxiBlocks Builder plugin for WordPress, caused by insufficient file ownership validation on the maxi_remove_custom_image_size AJAX action. It affects all plugin versions up to and including 2.1.8. Authenticated attackers with Author-level access or above can delete arbitrary files within the wp-content/uploads directory, including media uploaded by other users and administrators. The vulnerability was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the maxi_remove_custom_image_size AJAX handler in core/class-maxi-image-crop.php did not verify whether the requesting user owned the media file being targeted for deletion, nor did it validate a nonce prior to the fix. An authenticated attacker with at least Author-level WordPress access could craft an AJAX POST request supplying an arbitrary file path within wp-content/uploads, and the plugin would delete it without checking ownership. The patch (commit 3dff1db) adds check_ajax_referer('maxi_image_crop', 'nonce') and an ownership check using attachment_url_to_postid() combined with a delete_others_posts capability guard before any deletion is performed (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated attacker to permanently delete arbitrary media files from the wp-content/uploads directory, including images, documents, and other assets uploaded by other contributors, editors, or administrators. This can result in irreversible data loss, site defacement, or disruption of site functionality if critical media assets are removed. Because the vulnerability requires at least Author-level authentication, the risk is highest on multi-user WordPress sites where contributor or author roles are granted to untrusted individuals (Wordfence, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037% (3rd percentile), indicating a low near-term probability of exploitation. Exploitation requires valid WordPress credentials at Author level or above, limiting the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the MaxiBlocks Builder plugin version ≤ 2.1.8 using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain credentials: Acquire or use existing Author-level (or higher) WordPress credentials on the target site — this could be through phishing, credential stuffing, or a compromised account.
3. Identify target media files: Browse the site or use the WordPress media library to enumerate file paths within wp-content/uploads belonging to other users or administrators.
4. Craft malicious AJAX request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with action=maxi_remove_custom_image_size and the target file path as the old_media_src parameter, without a valid nonce (in unpatched versions, no nonce is required).
5. Achieve file deletion: The plugin's validate_and_delete_old_file() function processes the request and deletes the specified file from the server's filesystem without verifying ownership, resulting in permanent removal of the targeted media asset (GitHub Commit, GitHub Advisory).

• Network: Unusual authenticated POST requests to /wp-admin/admin-ajax.php with action=maxi_remove_custom_image_size and file paths referencing other users' media; requests originating from Author-level accounts targeting files they did not upload.
• Logs: WordPress access logs showing repeated AJAX calls to admin-ajax.php with the maxi_remove_custom_image_size action from a single user account; PHP error logs indicating missing files in wp-content/uploads.
• File System: Unexplained disappearance of media files from wp-content/uploads subdirectories, particularly files associated with administrator or other user accounts; gaps in media library entries without corresponding deletion records in WordPress revision history.

Update the MaxiBlocks Builder plugin to version 2.1.9 or later, which introduces nonce verification (check_ajax_referer) and file ownership validation before any deletion is processed (GitHub Commit). As an interim measure, restrict Author-level and above WordPress roles to only trusted users, and audit recent file deletions in wp-content/uploads to identify any unauthorized removals. Site administrators should also consider enabling file integrity monitoring on the uploads directory (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on April 24, 2026. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time (Wordfence).