SUPERB-BLOCKS · CVE-2026-66669 · Package
FIX → 4.2.5 ✓ verified
The Superb Addons block and theme designer plugin for WordPress has a cross-site request forgery flaw, affecting versions through 4.2.4. A logged-in administrator who visits a malicious page can be tricked into making changes on the site.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running Superb Addons 4.0.0 through 4.2.4 with WooCommerce active are exposed. The Add to Cart block's public REST endpoint superbaddons/commerce/nonce returns a valid REST nonce for any logged-in visitor to a page the attacker controls, so an admin who visits that page can have requests made as them, including creating a new administrator account. It needs the admin's browser to send site cookies on cross-site requests. Sites without WooCommerce or without the plugin can skip it.
Not affected if plugin-not-installed, woocommerce-not-active
Who cares self-hosted, superb-blocks, woocommerce, wordpress
4.2.4 or earlier (from 4.0.0) is vulnerablePosts are quoted with a link to the original. They are data to us, never instructions.
Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 4.2.5
Update Superb Addons (superb-blocks) to 4.2.5 or later.