EUVD-2026-40890
GHSA-pjfr-44xr-rrw5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as WordPress Contributor
-
DeliveryEnumerate or infer victim post URL path
-
ExploitCraft REST API request with attacker's own post_id
-
ExecutionSet post_path to victim post's path
-
PersistBypass authorization check via post_id mismatch
-
ImpactRead or delete victim's optimizer analysis record
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least Contributor role, which grants the edit_post capability that passes the authorization check. The Kadence Blocks plugin must be installed and active, and the optimizer feature (Optimize_Rest_Controller endpoints) must be accessible via the WordPress REST API - this is the default configuration when the plugin is active. The attacker must know or enumerate the post_path (URL path) of the target post; on public sites, post paths are often discoverable by browsing. Limiting factors: anonymous or unauthenticated users cannot exploit this; sites with only administrator or editor accounts (no Contributor-level users) are not exploitable; the impact is restricted to optimizer analysis metadata records, not raw post content or credentials. |
| Impact | The official NVD CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) rates this as Medium but contains a notable discrepancy: the vector encodes C:N (no confidentiality impact), yet the vulnerability description explicitly states that attackers can read optimizer analysis records belonging to other users' posts - a clear confidentiality breach. This analyst assesses C:L as more accurate than C:N, which would place the score closer to 5.4. The PR:L correctly reflects that Contributor-level authentication is required, meaningfully limiting the attack surface to registered site members, not anonymous visitors. No EPSS score was provided; given the lack of KEV listing and absence of reported POC, opportunistic at-scale exploitation appears unlikely. The practical risk on a single-author or administrator-only WordPress site is negligible; risk is most relevant to membership sites, news platforms, or multi-author blogs where untrusted Contributor accounts exist. The impact is confined to optimizer metadata records - not full post content, credentials, or database access - further limiting real-world blast radius. SSVC exploitation status is inferred as Proof-of-Concept or less, automatable is yes given the straightforward REST API mechanism, and technical impact is partial. |
| Exploit ScenarioDerived | An attacker with a legitimate Contributor account on the target WordPress site authenticates and obtains a valid nonce, then calls the Optimize_Rest_Controller REST endpoint (e.g., get_item or delete_item) passing their own post_id - a post they authored and can edit - while setting the post_path parameter to the URL path of a victim post (e.g., /2026/01/confidential-draft/). The capability check passes because post_id is legitimately theirs, but the storage layer retrieves or deletes the optimizer record keyed on sha256 of the victim's path. No public exploit code is confirmed; however, the attack requires only standard REST API calls exploitable with basic scripting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Kadence Blocks WordPress plugin versions up to and including 3.7.7 allows authenticated Contributor-level users to read or delete optimizer analysis records belonging to posts they do not own, by exploiting a parameter mismatch in four REST API endpoints of the Optimize_Rest_Controller. The authorization check binds to a user-supplied post_id while the storage layer retrieves records by sha256 of a separately supplied, attacker-controlled post_path, with no enforcement that these two parameters refer to the same post. No public exploit code or CISA KEV listing exists at time of analysis; however, the low barrier to exploitation - any registered Contributor can leverage this - makes it relevant for multi-author WordPress sites. EPSS data was not provided in the input.
RemediationAI
No specific patched release version is confirmed in the available input data; users should update Kadence Blocks to the latest version available beyond 3.7.7 and verify the fix is present by consulting the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/24cdd50f-742c-457c-85f7-9cccaf366e87?source=cve. As a compensating control, site administrators can remove Contributor-level user accounts or demote untrusted contributors to roles with no post editing capability (Subscriber), which eliminates the prerequisite capability check that the attacker exploits - trade-off is loss of contribution workflow for those users. Alternatively, administrators can disable or restrict REST API access to the Kadence optimizer endpoints at the network or WAF layer, noting this will break the plugin's optimizer functionality. WordPress sites with no multi-author contributor accounts are not exploitable and require no urgent action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR where the key used for access control differs from the key used to locate data. In the Kadence Blocks plugin (CPE: cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor:*:*:*:*:*:*:*:*), the Optimize_Rest_Controller exposes WordPress REST API endpoints - create_item(), get_item(), delete_item(), and bulk_delete_items() - that manage optimizer analysis records used by the plugin's page performance optimization feature. Capability checks call current_user_can('edit_post' or 'delete_post', $post_id) against a user-supplied post_id, which the attacker legitimately controls. However, the Table_Store storage layer (confirmed at Optimize/Store/Table_Store.php#L96) keys records by sha256($post_path) derived from a second, independently supplied post_path parameter (confirmed at Optimize/Path/Path.php#L60). Because no validation binds post_path to post_id, the capability check and the data retrieval operate on entirely different objects. Source code references in the WordPress plugin trac browser for tags 3.7.6 and 3.6.7 confirm the flaw exists across the affected range.
Know when Kadence Blocks Page Builder Toolkit For Gutenberg Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L reflects required Contributor authentication; C:L corrects NVD's C:N since reading others' optimizer records is a confidentiality breach.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Kadence Blocks - Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the Optimize_Rest_Controller's create_item(), get_item(), delete_item(), and bulk_delete_items() endpoints - authorization is checked via current_user_can('edit_post'/'delete_post', $post_id) against the user-supplied post_id, while the storage layer keys analysis records on sha256($post_path) from a separately supplied, attacker-controlled post_path parameter, with no enforcement that post_path corresponds to post_id. This makes it possible for authenticated attackers, with Contributor-level access and above, to read or delete optimizer analysis records belonging to posts owned by other users by submitting their own post_id (which passes the capability check) together with the victim post's path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Kadence Blocks Plugin IDOR and Authorization Bypass
View all 2Stored cross-site scripting in the Kadence Blocks - Page Builder Toolkit for Gutenberg Editor WordPress plugin affects a
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated con
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated con
Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authentica
Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypas
Exploit-DB