CVE-2026-12904: Kadence Blocks IDOR Vulnerability – Unauthorized Optimizer Data Access

Technical summary

CVE-2026-12904 is an Insecure Direct Object Reference (IDOR) vulnerability in the Kadence Blocks Gutenberg plugin's Optimize_Rest_Controller REST endpoints. The authorization logic validates user capabilities against a supplied post_id using standard WordPress capability checks (current_user_can('edit_post'/'delete_post', $post_id)), but the underlying storage retrieval uses a sha256 hash of an independently supplied post_path parameter with no validation that the two correspond. The affected endpoints—create_item(), get_item(), delete_item(), and bulk_delete_items()—permit an authenticated contributor-level user to bypass access controls by submitting a post_id they own alongside a victim's post path, resulting in unauthorized reads or deletions of optimizer analysis records. The vulnerability requires user authentication and intentional parameter manipulation but no multi-step interaction or user involvement from the victim.

Business impact

The exposure is narrowly scoped to optimizer analysis data rather than post content itself, limiting direct confidentiality or integrity risk to published content. However, organizations relying on Kadence Blocks for page optimization workflows may face data leakage of analysis records, competitive intelligence about site optimization strategies, or disruption of analysis workflows through deletion. The requirement for at least Contributor-level access means the threat is primarily internal—staff accounts or compromised low-privilege user accounts become a pivot point. Sites with open user registration or loosely managed contributor roles face elevated risk.

Affected systems

Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin versions up to and including 3.7.7 running on WordPress. The vulnerability requires the REST API to be enabled and the plugin to be activated. Any WordPress installation using this plugin to manage page optimization and permitting contributor-level accounts is in scope.

Exploitability

Exploitation is straightforward for an attacker with valid Contributor credentials or higher. No special tooling, zero-day techniques, or user interaction is required—an attacker need only craft REST API requests to the affected endpoints with a combination of a post_id they own and a victim's post_path. However, the attacker must already be authenticated, which requires either a valid account on the target site or compromise of one. Discovery of victim post paths may require reconnaissance but is not hidden in typical WordPress environments. The barrier to exploitation is low once access is obtained, but initial access is a prerequisite.

Remediation

Update Kadence Blocks to a patched version above 3.7.7 (verify against the vendor advisory for the specific fixed version). The core fix should enforce that the post_path parameter is validated to correspond to the post_id being authorized, or eliminate the mismatch by keying all storage and retrieval on the post_id alone. Organizations unable to patch immediately should audit user accounts with Contributor or higher roles and restrict REST API access to trusted internal networks if possible.

Patch guidance

Monitor Kadence Blocks release notes and the official WordPress plugin repository for version 3.7.8 or later. Apply patches during low-traffic periods to avoid disrupting active page-building workflows. Verify the vendor advisory to confirm that the patched version specifically addresses the IDOR in the Optimize_Rest_Controller endpoints. Test in a staging environment before production deployment to ensure optimizer functionality and REST API behavior remain intact.

Detection guidance

Review WordPress REST API logs for requests to /wp-json/kb-optimize/v1/* endpoints that contain post_id and post_path parameters where the post_id does not align with the authenticated user's owned posts, or where the post_path belongs to a post owned by a different user. Monitor for bulk_delete_items requests from Contributor accounts targeting posts outside their ownership. Enable WordPress logging and REST API audit plugins to capture parameter details. Check for suspicious deletions of optimizer records coinciding with authenticated sessions from unexpected user accounts.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), prioritize patching based on your organization's account governance practices. If you maintain strict Contributor role management and monitor user provisioning, the risk is lower. If you have open registration, loose contributor access, or high-value competitive optimization data, prioritize updates. The vulnerability is not in the public KEV catalog, suggesting active exploitation has not been widely reported, but the logic flaw is discoverable and the barrier to exploitation is low.

Risk score, explained

CVSS 4.3 reflects the confidentiality and integrity impact (unauthorized read/delete of analysis data) balanced against the requirement for authentication and post-owner involvement. The score does not account for the full organizational impact if contributor-level accounts are compromised or accounts are created by malicious insiders. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-accessible exploitation with low attack complexity, low privilege requirement, no user interaction, and limited scope—but the impact is integrity (unauthorized deletion) only; confidentiality is not directly compromised by the CVSS vector, though information leakage is possible in practice.

Frequently asked questions