CVE-2026-1242

Received Received - Intake

Authorization Bypass in BlockSpare WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-1242

Affected Vendors & Products

Vendor	Product	Version / Range
blockspare	blockspare	to 4.2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The BlockSpare WordPress plugin has an authorization bypass vulnerability due to incorrect logic in its permission callback. The flaw uses an AND operator instead of an OR operator, allowing authenticated users with Subscriber-level access or higher to bypass security checks and create posts they should not be able to.

Detection Guidance

This vulnerability can be detected by checking for unauthorized post creation by Subscriber-level users. Review WordPress logs for unusual post creation activity or inspect plugin files for incorrect permission logic in BlockSpare versions up to 4.2.6.

Impact Analysis

If you use the BlockSpare plugin, attackers with basic user access could create unauthorized posts on your WordPress site. This could lead to spam, misleading content, or other malicious activities without proper authorization checks being enforced.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized content creation, which could violate data integrity or access control requirements in standards like GDPR or HIPAA. Unauthorized posts might expose sensitive data or misrepresent information, leading to regulatory violations.

Mitigation Strategies

Update the BlockSpare plugin to the latest version, which is 4.2.7 or higher, to fix the authorization bypass issue.

Hi! I’m here to help you understand CVE-2026-1242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70