Superb Addons <= 4.2.3 - Authenticated (Contributor+) Form Access Control Bypass via Autosave
- ID
- WPSEC-2026-1681
- Plugin
- Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More (superb-blocks)
- Affected
- from 4.0.0 before 4.2.4
- Remediation
- Update to 4.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Superb Addons on WPSec AttackSurface
- Fix released
- Published
Description
The Superb Addons plugin for WordPress is vulnerable to an authorization bypass of its optional form access control via autosave requests in all versions up to, and including, 4.2.3. This is due to the FormAccessControl::OnInsertPostData filter returning early whenever DOING_AUTOSAVE is set, even though an autosave of a user's own draft writes the post content directly. It also did not count the webhookSecret attribute as a sensitive setting. This makes it possible for authenticated attackers with contributor-level access and above, whose role has limited form permissions, to store form blocks with sensitive settings they may not configure (such as notification recipients, webhook URLs, redirects or integration lists) in their own drafts. Those settings take effect once a user with full form permissions saves or publishes the post. The form access control feature must be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1681/
- https://plugins.svn.wordpress.org/superb-blocks/tags/4.2.4/
- https://wordpress.org/plugins/superb-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS