Junglewise Threat Intelligence

CVE-2026-12904: Kadence Blocks IDOR in Optimize_Rest_Controller

CVE-2026-12904 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Executive brief

Kadence Blocks, a popular WordPress plugin for page building, contains a security flaw that allows users with basic contributor access to view or delete optimization data belonging to other users' posts. This occurs because the system does not properly verify that the data being accessed belongs to the specific post the user is authorized to edit. While this does not allow full site takeover, it could lead to the loss of performance optimization records and unauthorized access to internal site structure information.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) within the Optimize_Rest_Controller's create_item(), get_item(), delete_item(), and bulk_delete_items() endpoints. The root cause is a mismatch between the object used for authorization and the object accessed: the plugin validates permissions using a user-supplied post_id via current_user_can(), but retrieves or deletes data from the storage layer using a separate, attacker-controlled post_path parameter (hashed via sha256). Because there is no enforcement that the post_path corresponds to the post_id, an authenticated attacker with Contributor-level access can manipulate the post_path to target records belonging to posts they do not own. A patch is available in versions following 3.7.7.

Affected products

  • Kadence WP Kadence Blocks – Gutenberg Blocks for Page Builder Features up to and including 3.7.7

Timeline

  • 2026-07-01: advisory: NVD publication date

References