CVE-2026-1242

Name of the Vulnerable Software and Affected Versions BlockSpare versions prior to 4.2.7

Description The BlockSpare plugin for WordPress contains an authorization bypass flaw caused by incorrect logic within the permission callback. The issue stems from the use of an AND (&&) operator instead of an OR (||) operator, allowing authenticated users with Subscriber-level access or higher to circumvent authorization checks and create arbitrary posts.

Recommendations Update the plugin to version 4.2.7 or later.