# Superb Addons <= 4.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Form Configuration Overwrite

- **ID:** WPSEC-2026-1682
- **Plugin:** Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More (`superb-blocks`), https://wordpress.org/plugins/superb-blocks/
- **Affected versions:** from 4.0.0 before 4.2.4
- **Fixed in:** 4.2.4 (Update to 4.2.4 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/superb-blocks
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1682/

## Description

The Superb Addons plugin for WordPress is vulnerable to an Insecure Direct Object Reference via the formId attribute of form blocks in all versions up to, and including, 4.2.3. This is due to FormRegistry::OnSavePost() making the saving post the source of every formId found in its content and overwriting that form's stored configuration and webhook secret, without checking that the user can edit the post that already holds the form. This makes it possible for authenticated attackers with contributor-level access and above to save a draft containing another author's form ID, which is public in the page's data-form-id markup. That form's live submissions are then processed with the attacker's settings, such as notification recipients, webhook URL or redirect URL, which can send other visitors' submissions to the attacker.

## References

- https://wpsec.com/vuln/WPSEC-2026-1682/
- https://plugins.svn.wordpress.org/superb-blocks/tags/4.2.4/
- https://wordpress.org/plugins/superb-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1682/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.