EUVD-2026-40890
GHSA-pjfr-44xr-rrw5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L reflects required Contributor authentication; C:L corrects NVD's C:N since reading others' optimizer records is a confidentiality breach.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Kadence Blocks - Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the Optimize_Rest_Controller's create_item(), get_item(), delete_item(), and bulk_delete_items() endpoints - authorization is checked via current_user_can('edit_post'/'delete_post', $post_id) against the user-supplied post_id, while the storage layer keys analysis records on sha256($post_path) from a separately supplied, attacker-controlled post_path parameter, with no enforcement that post_path corresponds to post_id. This makes it possible for authenticated attackers, with Contributor-level access and above, to read or delete optimizer analysis records belonging to posts owned by other users by submitting their own post_id (which passes the capability check) together with the victim post's path.
AnalysisAI
Kadence Blocks WordPress plugin versions up to and including 3.7.7 allows authenticated Contributor-level users to read or delete optimizer analysis records belonging to posts they do not own, by exploiting a parameter mismatch in four REST API endpoints of the Optimize_Rest_Controller. The authorization check binds to a user-supplied post_id while the storage layer retrieves records by sha256 of a separately supplied, attacker-controlled post_path, with no enforcement that these two parameters refer to the same post. No public exploit code or CISA KEV listing exists at time of analysis; however, the low barrier to exploitation - any registered Contributor can leverage this - makes it relevant for multi-author WordPress sites. EPSS data was not provided in the input.
Technical ContextAI
The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR where the key used for access control differs from the key used to locate data. In the Kadence Blocks plugin (CPE: cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor:*:*:*:*:*:*:*:*), the Optimize_Rest_Controller exposes WordPress REST API endpoints - create_item(), get_item(), delete_item(), and bulk_delete_items() - that manage optimizer analysis records used by the plugin's page performance optimization feature. Capability checks call current_user_can('edit_post' or 'delete_post', $post_id) against a user-supplied post_id, which the attacker legitimately controls. However, the Table_Store storage layer (confirmed at Optimize/Store/Table_Store.php#L96) keys records by sha256($post_path) derived from a second, independently supplied post_path parameter (confirmed at Optimize/Path/Path.php#L60). Because no validation binds post_path to post_id, the capability check and the data retrieval operate on entirely different objects. Source code references in the WordPress plugin trac browser for tags 3.7.6 and 3.6.7 confirm the flaw exists across the affected range.
RemediationAI
No specific patched release version is confirmed in the available input data; users should update Kadence Blocks to the latest version available beyond 3.7.7 and verify the fix is present by consulting the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/24cdd50f-742c-457c-85f7-9cccaf366e87?source=cve. As a compensating control, site administrators can remove Contributor-level user accounts or demote untrusted contributors to roles with no post editing capability (Subscriber), which eliminates the prerequisite capability check that the attacker exploits - trade-off is loss of contribution workflow for those users. Alternatively, administrators can disable or restrict REST API access to the Kadence optimizer endpoints at the network or WAF layer, noting this will break the plugin's optimizer functionality. WordPress sites with no multi-author contributor accounts are not exploitable and require no urgent action.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated con
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated con
Authorization bypass in the Kadence Blocks WordPress plugin (all versions through 3.7.7) allows authenticated contributo
Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authentica
Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypas
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today