BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
Strategic Overview
- Status
- Unpatched
- Affected Version
<= 4.2.6- CVSS
- 4.3Medium
- Weakness type
- CWE-863 · Incorrect Authorization
- CVE
CVE-2026-1242
At a glance
CVE-2026-1242 is a medium-severity Incorrect Authorization vulnerability in the BlockSpare WordPress plugin, affecting versions <= 4.2.6. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Subscriber level or above. No fixed release has been reported yet; treat installations running this software as exposed. Disclosed September 2026, reported by Osvaldo Noe Gonzalez Del Rio (Os).
Vulnerability Overview
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.
CWE-863: Incorrect Authorization
Reaching this weakness in BlockSpare <= 4.2.6 takes an account at Subscriber level or above. Incorrect authorization means a permission check exists but evaluates the wrong thing, so it passes for callers it was meant to stop.
The action runs for users the code intended to exclude, with the same effect as having no check at all. No fixed build of this plugin is recorded for BlockSpare yet, so installs running <= 4.2.6 stay exposed until the vendor ships one.
Remediation
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. No patched version is recorded yet, which is the case where a filtering layer matters most, because there is nothing to update to.
- Login Security
- Alerts
External References
Related records
Other vulnerabilities in BlockSpare – Gutenberg Blocks for News, Magazine, Blog & Business Websites
- 6.4CVE-2025-4684: BlockSpare Stored XSS
CVE-2025-4684 - 6.4CVE-2025-47495: Blockspare <= 3.2.9 Stored Cross-Site Scripting
CVE-2025-47495 - 6.4CVE-2024-47363: Blockspare <= 3.2.4 Stored Cross-Site Scripting
CVE-2024-47363 - 6.4CVE-2024-8325: Gutenberg Page Builder Blocks… Stored XSS
CVE-2024-8325 - 6.4CVE-2024-43164: Blockspare <= 3.2.0 Stored Cross-Site Scripting
CVE-2024-43164 - 6.3CVE-2022-4974: Freemius SDK <= 2.4.2 Missing Authorization Checks
CVE-2022-4974 - 6.1CVE-2024-13362: Freemius <= 2.10.1 Reflected DOM-Based XSS
CVE-2024-13362 - 6.1CVE-2023-33999: Freemius SDK <= 2.5.9 Reflected Cross-Site Scripting
CVE-2023-33999
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C