# Superb Addons <= 4.2.4 - Cross-Site Request Forgery via REST Nonce Exposure in 'commerce/nonce' Endpoint

- **ID:** WPSEC-2026-2238
- **Plugin:** Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More (`superb-blocks`), https://wordpress.org/plugins/superb-blocks/
- **Affected versions:** from 4.0.0 before 4.2.5
- **Fixed in:** 4.2.5 (Update to 4.2.5 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/superb-blocks
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2238/

## Description

The Superb Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery via the superbaddons/commerce/nonce REST endpoint of the Add to Cart block in all versions from 4.0.0 up to, and including, 4.2.4. The cause is that the endpoint, registered only when WooCommerce is active, is public (permission_callback __return_true), works out the logged-in user from the authentication cookie even when the request carries no REST nonce, and returns a valid 'wp_rest' nonce for that user. WordPress core's REST CORS headers echo back the request origin and allow credentials. This makes it possible for unauthenticated attackers to read a logged-in victim's REST nonce from a page they control and then send authenticated REST API requests as that victim. If the victim is an administrator, this can include creating a new administrator account. Exploitation requires tricking the victim into visiting the attacker's page, and it works only when the victim's browser sends the site's cookies on cross-site requests.

## References

- https://wpsec.com/vuln/WPSEC-2026-2238/
- https://plugins.svn.wordpress.org/superb-blocks/tags/4.2.5/
- https://wordpress.org/plugins/superb-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2238/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.