{
 "id": "WPSEC-2026-1681",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1681/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1681/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1681/index.md",
 "title": "Superb Addons <= 4.2.3 - Authenticated (Contributor+) Form Access Control Bypass via Autosave",
 "description": "The Superb Addons plugin for WordPress is vulnerable to an authorization bypass of its optional form access control via autosave requests in all versions up to, and including, 4.2.3. This is due to the FormAccessControl::OnInsertPostData filter returning early whenever DOING_AUTOSAVE is set, even though an autosave of a user's own draft writes the post content directly. It also did not count the webhookSecret attribute as a sensitive setting. This makes it possible for authenticated attackers with contributor-level access and above, whose role has limited form permissions, to store form blocks with sensitive settings they may not configure (such as notification recipients, webhook URLs, redirects or integration lists) in their own drafts. Those settings take effect once a user with full form permissions saves or publishes the post. The form access control feature must be enabled.",
 "plugin": {
  "slug": "superb-blocks",
  "name": "Superb Addons",
  "full_name": "Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More",
  "wordpress_org": "https://wordpress.org/plugins/superb-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/superb-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/superb-blocks"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0",
    "from_inclusive": true,
    "to": "4.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0 before 4.2.4"
  ]
 },
 "introduced_in": "4.0.0",
 "fixed_in": "4.2.4",
 "remediation": "Update to 4.2.4 or later.",
 "fix_released": "2026-10-26T00:05:55+00:00",
 "published": "2026-10-27T00:42:20+00:00",
 "updated": "2026-10-26T09:30:47.782700+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1681/",
  "https://plugins.svn.wordpress.org/superb-blocks/tags/4.2.4/",
  "https://wordpress.org/plugins/superb-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/superb-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}