CVE-2026-12904 Overview
CVE-2026-12904 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress. The flaw exists in all versions up to and including 3.7.7. Authenticated attackers with Contributor-level access or higher can read or delete optimizer analysis records belonging to posts owned by other users. The vulnerability stems from a mismatch between the object used for authorization and the object actually accessed in the Optimize_Rest_Controller endpoints. The issue is tracked under CWE-639 — Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated attackers with Contributor-level access can read and delete optimizer analysis records associated with posts owned by other users on affected WordPress sites.
Affected Products
- Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress
- All versions up to and including 3.7.7
- WordPress sites that expose the plugin's Optimize_Rest_Controller REST endpoints
Discovery Timeline
- 2026-07-01 - CVE-2026-12904 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-12904
Vulnerability Analysis
The vulnerability resides in the Optimize_Rest_Controller class within the Kadence Blocks Optimizer subsystem. The affected endpoints include create_item(), get_item(), delete_item(), and bulk_delete_items(). Each endpoint performs authorization using current_user_can('edit_post', $post_id) or current_user_can('delete_post', $post_id) against a user-supplied post_id parameter. However, the underlying storage layer keys analysis records on sha256($post_path), where post_path is a separate, attacker-controlled parameter. The controller never validates that the supplied post_path actually corresponds to the supplied post_id. This design flaw allows an authenticated attacker to satisfy the capability check using a post they legitimately own while accessing records tied to a completely different victim post.
Root Cause
The root cause is a classic Insecure Direct Object Reference pattern [CWE-639]. Authorization decisions are decoupled from the object identifier used for storage lookups. Because the storage layer in Table_Store.php (line 96) keys records on sha256($post_path) rather than on $post_id, the capability check on $post_id provides no protection over the record actually retrieved or modified.
Attack Vector
An attacker authenticates to the target WordPress site with a Contributor account or higher. The attacker then issues a REST request to a vulnerable endpoint in Optimize_Rest_Controller — the affected code paths are referenced at Optimize_Rest_Controller.php lines 153, 197, 232, 339, 383, 420, and 458. The request contains a post_id referencing a post the attacker owns, alongside a post_path referencing the victim's post. The capability check passes because the attacker has edit_post or delete_post rights on their own post_id. The storage lookup then hashes the victim's post_path and returns or deletes the victim's optimizer analysis record. No user interaction is required beyond the attacker's own authenticated request.
See the Wordfence advisory and the plugin changeset for the full technical reference.
Detection Methods for CVE-2026-12904
Indicators of Compromise
- REST API requests to Kadence Blocks Optimizer endpoints (paths under /wp-json/kadence-blocks/*/optimize) where the submitted post_id and post_path parameters reference different posts.
- Unexpected deletions or reads of optimizer analysis records for posts not owned by the requesting user.
- Contributor-level or Author-level accounts issuing high volumes of requests to create_item, get_item, delete_item, or bulk_delete_items endpoints.
Detection Strategies
- Enable WordPress REST API request logging and alert on Kadence Blocks Optimizer endpoint calls that include both post_id and post_path fields with mismatched ownership.
- Correlate post_id values in REST requests against post_path values in the same request to identify authorization/object mismatches.
- Review WordPress audit logs for optimizer record deletions attributed to non-administrator accounts.
Monitoring Recommendations
- Monitor web server access logs for POST and DELETE requests to /wp-json/ routes exposed by Kadence Blocks with an emphasis on low-privilege authenticated users.
- Track anomalous Contributor and Author account activity, including any REST API usage that deviates from normal editorial workflows.
- Alert on repeated 200-status responses to Optimizer endpoints from accounts that do not typically interact with page optimization features.
How to Mitigate CVE-2026-12904
Immediate Actions Required
- Update the Kadence Blocks plugin to the latest available version above 3.7.7 that addresses the IDOR flaw.
- Audit existing Contributor, Author, and Editor accounts and remove any that are unused, dormant, or unverified.
- Review optimizer analysis records for signs of unauthorized deletion or access following the vulnerability's disclosure.
Patch Information
The vendor has released a fix through the plugin changeset 3590217. Site administrators should upgrade to the latest version of Kadence Blocks that supersedes 3.7.7. Refer to the Wordfence vulnerability record for patched version details.
Workarounds
- Restrict access to the Kadence Blocks Optimizer REST endpoints at the web server or WAF layer until patching is complete.
- Temporarily reduce user roles that do not require content-editing privileges to Subscriber, eliminating exposure to the Contributor-level attack prerequisite.
- Deactivate the Kadence Blocks plugin if it is not required for production operations until an updated version can be deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
