Blockspare Gutenberg Blocks For News Magazine Blog Business Websites
Monthly
Authorization bypass in the BlockSpare plugin for WordPress allows authenticated users with Subscriber-level access to create arbitrary posts on sites running versions up to and including 4.2.6. The issue is caused by a permission callback that combines capability checks with AND instead of OR, letting low-privileged accounts pass the authorization gate; impact is integrity-only with no data disclosure or service disruption. No public exploit identified at time of analysis, but sites with open user registration can significantly expand the attacker pool because attackers can self-register as Subscribers.
Authorization bypass in the BlockSpare plugin for WordPress allows authenticated users with Subscriber-level access to create arbitrary posts on sites running versions up to and including 4.2.6. The issue is caused by a permission callback that combines capability checks with AND instead of OR, letting low-privileged accounts pass the authorization gate; impact is integrity-only with no data disclosure or service disruption. No public exploit identified at time of analysis, but sites with open user registration can significantly expand the attacker pool because attackers can self-register as Subscribers.