CVE-2026-1242

MediumCVSS 4.3/10Last modified Sep 21, 2026

Description

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
blockspare	BlockSpare – Gutenberg Blocks for News, Magazine, Blog & Business Websites	<= 4.2.6

References

Timeline

Published: Sep 19, 2026
Last modified: Sep 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-124217.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and includi CVE-2026-1242106.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-1242188.2The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file pat CVE-2026-1242247.0Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges loc CVE-2026-1242257.8Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.CVE-2026-1242268.8Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.CVE-2026-1242277.5Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1242288.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to CVE-2026-1242296.6Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.CVE-2026-124237.5A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a sem CVE-2026-1242336.5Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-124247.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4