Executive brief
The BlockSpare plugin for WordPress has a logic error in its permission checks that allows authenticated users with basic subscriber-level access to create arbitrary posts. An attacker with a low-privilege account can exploit this to publish unauthorized content or modify the site's content without proper permissions.
Technical details
The vulnerability stems from incorrect logic in a permission callback that uses AND (&&) instead of OR (||) operators, allowing the check to fail even when it should succeed. Authenticated attackers with Subscriber-level privileges or above can bypass authorization controls and create arbitrary posts via the REST API. The issue affects all versions up to and including 4.2.6.
Affected products
- BlockSpare BlockSpare up to 4.2.6
Timeline
- 2026-09-19: disclosed