CVE-2026-12904

Name of the Vulnerable Software and Affected Versions Kadence Blocks – Gutenberg Blocks for Page Builder Features versions prior to 3.7.8

Description An Insecure Direct Object Reference exists due to a mismatch between the object used for authorization and the object accessed in the Optimize Rest Controller's create item(), get item(), delete item(), and bulk delete items() endpoints. While authorization is verified using current user can('edit post'/'delete post', $post id) against the post id parameter, the storage layer retrieves records based on a SHA256 hash of the post path parameter. Because there is no enforcement ensuring that post path corresponds to the post id, authenticated attackers with Contributor-level access or higher can read or delete optimizer analysis records of posts owned by other users by providing their own post id and the victim's post path.

Recommendations Update to a version newer than 3.7.7.