Charlie Eriksen has discovered multiple vulnerabilities in the Global Content Blocks plugin for WordPress, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to disclose potentially sensitive information.

1) The wp-content/plugins/global-content-blocks/resources/tinymce/gcb_ajax_add.php script does not properly verify permissions before creating code blocks. This can be exploited to create arbitrary code blocks and execute PHP code.

2) The wp-content/plugins/global-content-blocks/resources/tinymce/gcbvalue.php and wp-content/plugins/global-content-blocks/gcb/gcb_export.php scripts does not properly restrict access, which can be exploited to disclose the contents of code blocks.

The vulnerabilities are confirmed in version 1.5.1. Other versions may also be affected.

Solution
Update to version 1.5.2.

Provided and/or discovered by
Charlie Eriksen via Secunia.

Original Advisory
Global Content Blocks:
http://wordpress.org/extend/plugins/global-content-blocks/changelog/

Deep Links
Links available to Secunia VIM customers