CVE-2026-6675: 
WordPress vulnerability analysis and mitigation

CVE-2026-6675 is an Unauthenticated Open Email Relay vulnerability in the Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress, affecting all versions up to and including 2.2.0. The flaw allows unauthenticated remote attackers to send arbitrary emails to any recipient through the affected site's mail server, effectively turning it into an open mail relay. It was disclosed on April 21, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, GitHub Advisory).

The root cause is classified as CWE-20 (Improper Input Validation): the plugin exposes a public REST API route that accepts a recipient email address parameter without performing adequate server-side validation or authorization checks. Because the endpoint is publicly accessible with no authentication requirement, any network-reachable attacker can supply an arbitrary recipient address and trigger the WordPress site's mail server to deliver email on their behalf. The vulnerable code is identifiable in class-responsive-block-editor-addons.php at lines 2212, 2324, and 2403 of the plugin source (Wordfence, GitHub Advisory).

Successful exploitation allows unauthenticated attackers to abuse the affected WordPress site's mail server as an open relay, sending arbitrary emails to any recipient of their choosing. This can be leveraged for large-scale spam distribution, phishing campaigns, or malicious email propagation, potentially damaging the site's domain reputation and causing IP blocklisting of the mail server. There is no direct confidentiality or availability impact; the primary risk is integrity-related through email abuse (Wordfence, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.048% (0.000480), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it straightforward to exploit if discovered.

1. Reconnaissance: Identify WordPress sites running the Responsive Blocks – Page Builder for Blocks & Patterns plugin (versions ≤ 2.2.0) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Locate the vulnerable REST API endpoint: Review the plugin source code or WordPress REST API discovery (/wp-json/) to identify the public route that handles email sending functionality (see class-responsive-block-editor-addons.php lines 2212, 2324, 2403).
3. Craft a malicious request: Construct an unauthenticated HTTP POST request to the identified REST API endpoint, supplying an arbitrary recipient email address in the relevant parameter (no authentication token or nonce required).
4. Send the request: Submit the crafted request to the target WordPress site. The plugin passes the attacker-controlled recipient address to the site's mail server without validation, causing the server to deliver the email.
5. Scale abuse: Automate requests to send bulk spam or phishing emails through the compromised mail server, leveraging the site's domain reputation and mail infrastructure (Wordfence).

• Network: Unusual volume of outbound SMTP traffic from the WordPress server; REST API requests to the plugin's email-sending endpoint from unexpected or foreign IP addresses.
• Logs: WordPress access logs showing repeated unauthenticated POST requests to the plugin's REST API route (e.g., /wp-json/responsive-block-editor-addons/...); mail server logs (e.g., Postfix, Sendmail) showing high volumes of outbound email to diverse, unrelated recipients.
• Mail Server: Sudden increase in bounce-back (NDR) messages; mail server IP appearing on spam blocklists (e.g., Spamhaus, MX Toolbox alerts).
• Application: WordPress debug logs showing email function calls with externally supplied recipient addresses not matching expected site contacts.

Update the Responsive Blocks – Page Builder for Blocks & Patterns plugin to a version newer than 2.2.0, which contains the fix for this vulnerability. A patch was made available on April 21, 2026 (GitHub Advisory). As an interim workaround, site administrators can disable the plugin until an update is applied, or restrict access to the WordPress REST API for unauthenticated users using a security plugin or server-level firewall rules. Organizations should audit all WordPress installations for the affected plugin version and prioritize patching.

The vulnerability was reported and assigned by Wordfence, which maintains a dedicated threat intelligence entry for it (Wordfence). A brief technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregator postings has been observed.