CVE-2026-1242
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.
| CWE | CWE-863 |
| Vendor | blockspare |
| Product | blockspare – gutenberg blocks for news, magazine, blog & business websites |
| Published | Sep 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for blockspare blockspare – gutenberg blocks for news, magazine, blog & business websites
Be the first to know when new medium vulnerabilities affecting blockspare blockspare – gutenberg blocks for news, magazine, blog & business websites are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
blockspare / BlockSpare – Gutenberg Blocks for News, Magazine, Blog & Business Websites
0 ≤ 4.2.6
References
Credits
Osvaldo Noe Gonzalez Del Rio (Os)