CVE-2026-6675

BRIEFING NOTE: CVE-2026-6675 OVERVIEW The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress versions up to and including 2.2.0 contains an unauthenticated open email relay vulnerability. Insufficient authorization checks and missing server-side validation on a public REST API endpoint allow attackers to send arbitrary emails through the affected site's mail server to any recipient without authentication. SEVERITY This vulnerability has a CVSS v3.1 score of 5.3 (Medium) with a network-based attack vector requiring no user interaction or special privileges. While the attack is easily exploitable with low complexity, the impact is limited to integrity violations; there is no confidentiality or availability impact. The vulnerability effectively converts affected WordPress installations into open mail relays, enabling spam distribution, phishing campaigns, and reputational damage. EXPLOITATION STATUS There is currently no evidence of active exploitation, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00048 indicates minimal likelihood of near-term exploitation. However, the straightforward nature of the vulnerability and public availability of WordPress plugins suggest that exploitation code could be developed or released following wider disclosure.