Block custom-CSS edit_css filter bypass through a block-recognizer differential

Summary

The custom-CSS security gate relies on a block-recognition condition that differs from the parser’s accepted whitespace forms. An Author can therefore retain block custom CSS despite lacking edit_css.

Affected Products

WordPress core 7.0.4; block custom-CSS support.

Affected Scope

Product

WordPress

Component

Block custom-CSS support and authorization gate

Affected function

wp-includes/block-supports/custom-css.php; has_blocks(); render_block(); block customCSS attribute

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-862; CWE-20

Technical Summary

A recognizer/parser differential causes the custom-CSS authorization gate to fail open for accepted whitespace variants, allowing the retained CSS to reach rendering.

Prerequisites and Permissions

Authenticated Author able to submit block markup but lacking edit_css; a theme/block supporting custom CSS is required.

Affected Locations

wp-includes/block-supports/custom-css.php:65 custom CSS output sink; 174–175 security/control gate; block markup/customCSS input and has_blocks() decision.

Reproducible Proof

A controlled Author submission using the documented parser-recognized whitespace variant retained the custom CSS and changed rendered styling; the exact payload is withheld.

Vulnerable Code

if ( ! has_blocks( $content ) ) {
	$content = remove_unsafe_custom_css( $content );
}
return render_block( $content );

Severity

low

Technical Analysis

The custom CSS sanitizer checks has_blocks() and uses a literal delimiter form, while the block parser accepts broader whitespace around the delimiter. The recognizer says no block is present, so the edit_css stripping branch is skipped; later custom CSS serialization emits the retained value.

Impact

Integrity impact: an Author can persist block custom CSS without edit_css, affecting rendered styling. No script execution or server-side execution is claimed.

Remediation

Use the canonical block parser/recognizer for the security decision, enforce edit_css independently of delimiter formatting, and add whitespace-variant regression tests.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.