Superb Addons <= 4.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Form Configuration Overwrite
- ID
- WPSEC-2026-1682
- Plugin
- Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More (superb-blocks)
- Affected
- from 4.0.0 before 4.2.4
- Remediation
- Update to 4.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Superb Addons on WPSec AttackSurface
- Fix released
- Published
Description
The Superb Addons plugin for WordPress is vulnerable to an Insecure Direct Object Reference via the formId attribute of form blocks in all versions up to, and including, 4.2.3. This is due to FormRegistry::OnSavePost() making the saving post the source of every formId found in its content and overwriting that form's stored configuration and webhook secret, without checking that the user can edit the post that already holds the form. This makes it possible for authenticated attackers with contributor-level access and above to save a draft containing another author's form ID, which is public in the page's data-form-id markup. That form's live submissions are then processed with the attacker's settings, such as notification recipients, webhook URL or redirect URL, which can send other visitors' submissions to the attacker.
References
- https://wpsec.com/vuln/WPSEC-2026-1682/
- https://plugins.svn.wordpress.org/superb-blocks/tags/4.2.4/
- https://wordpress.org/plugins/superb-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS