Superb Addons <= 4.2.4 - Cross-Site Request Forgery via REST Nonce Exposure in 'commerce/nonce' Endpoint
- ID
- WPSEC-2026-2238
- Plugin
- Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More (superb-blocks)
- Affected
- from 4.0.0 before 4.2.5
- Remediation
- Update to 4.2.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-352
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Superb Addons on WPSec AttackSurface
- Fix released
- Published
Description
The Superb Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery via the superbaddons/commerce/nonce REST endpoint of the Add to Cart block in all versions from 4.0.0 up to, and including, 4.2.4. The cause is that the endpoint, registered only when WooCommerce is active, is public (permission_callback __return_true), works out the logged-in user from the authentication cookie even when the request carries no REST nonce, and returns a valid 'wp_rest' nonce for that user. WordPress core's REST CORS headers echo back the request origin and allow credentials. This makes it possible for unauthenticated attackers to read a logged-in victim's REST nonce from a page they control and then send authenticated REST API requests as that victim. If the victim is an administrator, this can include creating a new administrator account. Exploitation requires tricking the victim into visiting the attacker's page, and it works only when the victim's browser sends the site's cookies on cross-site requests.
References
- https://wpsec.com/vuln/WPSEC-2026-2238/
- https://plugins.svn.wordpress.org/superb-blocks/tags/4.2.5/
- https://wordpress.org/plugins/superb-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS