CVE-2026-1242
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The BlockSpare plugin for WordPress in versions up to and including 4.2.6 is vulnerable to authorization bypass due to incorrect logic in the permission callback, using an AND (&&) operator instead of an OR (||) operator. Authenticated attackers with Subscriber-level access and above can bypass authorization checks and create arbitrary posts.
Risk Assessment
An attacker can create arbitrary posts, potentially leading to site clutter or publication of unauthorized content. This can affect the integrity and credibility of the site.
Recommendation
Update the BlockSpare plugin to a version later than 4.2.6. Until then, restrict Subscriber privileges and monitor for new posts.
Other vulnerabilities in BlockSpare
Original NVD description (English source)
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS