BlockSpare CVE-2026-1242

Requires an authenticated WordPress account at Subscriber level or above on a site running BlockSpare <= 4.2.6; sites allowing open user registration expand the attacker pool significantly. Exploitation targets the plugin's REST/template save endpoint whose permission_callback uses an AND (&&) operator instead of OR (||), causing the capability check to pass incorrectly. No user interaction or admin privileges are needed, but impact is limited to creating arbitrary posts (integrity only) - no data disclosure or service disruption. Sites without the BlockSpare plugin, or that have upgraded past 4.2.6, are unaffected.

This is a genuine but low-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) reflects a network-reachable, low-complexity flaw that nonetheless requires authenticated Subscriber-level access (PR:L) and yields integrity-only impact (I:L) - no confidentiality or availability effect. The root cause is a straightforward logic error (an AND used where an OR was needed in a REST permission callback), which is trivially reliable once a low-privilege account exists, but the bar of holding a valid Subscriber account and the limited outcome (creating arbitrary posts, typically pending/draft depending on the target post type) keep real-world risk modest. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or automated exploitation. The signals are internally consistent - a real, easily-triggered authorization bug of limited blast radius - making this a routine patch-management priority rather than an emergency. Note the input Tag 'Authentication Bypass' conflicts with the actual CWE-863 (Improper Authorization) and PR:L vector: this is authorization bypass by an authenticated user, not an unauthenticated authentication bypass.

An attacker registers or obtains a Subscriber account on a WordPress site running BlockSpare <=4.2.6 (open registration is common on blogs/news sites, the plugin's target market). They send an authenticated REST request to the plugin's save-templates/post-creation endpoint whose flawed permission callback (using && instead of ||) evaluates to permit, allowing them to create arbitrary posts they should not be able to create. No public exploit code is identified at time of analysis, but the flaw is trivially reproducible given the described one-operator logic bug.