{"id":"CVE-2026-66669","kind":"vulnerability","aliases":["CVE-2026-66669"],"related":[],"title":"WordPress Superb Addons plugin: cross-site request forgery lets attackers act as admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns &amp; Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns &amp; Theme Designer: from n/a through 4.2.4.","summary":"The Superb Addons block and theme designer plugin for WordPress has a cross-site request forgery flaw, affecting versions through 4.2.4. A logged-in administrator who visits a malicious page can be tricked into making changes on the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"superb-blocks","fixed":["4.2.5"],"affected":">= 4.0.0, <= 4.2.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","superb-blocks","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","woocommerce-not-active"],"how_to_check":"In WordPress admin > Plugins, check the Superb Addons (superb-blocks) version; 4.2.4 or earlier (from 4.0.0) is vulnerable. Also check that WooCommerce is active: the vulnerable endpoint /wp-json/superbaddons/commerce/nonce exists only then. Without WooCommerce the endpoint is not registered.","fix":"Update Superb Addons (superb-blocks) to 4.2.5 or later.","status":"open","published_at":"2026-11-07T09:17:16+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","triaged_at":"2026-11-07T09:47:47+00:00","updated_at":"2026-11-07T09:49:25+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-07T09:47:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Superb Addons plugin: cross-site request forgery lets attackers act as admins","impact":"medium","summary":"The Superb Addons block and theme designer plugin for WordPress has a cross-site request forgery flaw, affecting versions through 4.2.4. A logged-in administrator who visits a malicious page can be tricked into making changes on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","superb-blocks","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker performs unauthorized actions as a logged-in administrator","analyst_note":"Find the fixed version and the vulnerable endpoints in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-66669) or the Wordfence/plugin changelog.","how_to_check":"- Check the installed version of the Superb Addons: Blocks, Patterns & Theme Designer plugin (`superb-blocks`) in the WordPress admin plugins list.\n- Confirm whether the installed version is `4.2.4` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Superb Addons (superb-blocks) WordPress plugin at version 4.2.4 or earlier are in scope. The sources do not say which actions are affected or whether any specific setting or login state changes exposure, so the attack surface is unknown. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4262,"output_tokens":596,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the vulnerable endpoints in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-66669) or the Wordfence/plugin changelog.","search":"'-2026':16A,19A '-66669':17A,20A '4.2.4':54B,108C 'act':12A 'addon':3A,35B,84C,100C 'admin':14A 'administr':59B 'affect':51B,98C 'allow':92C 'attack':11A 'block':30B,36B,85C,91C,101C 'blocks':23A 'chang':70B 'cross':6A,46B,75C,93C 'cross-sit':5A,45B,74C 'csrf':79C 'cve':15A,18A 'design':39B,88C,104C 'flaw':50B 'forgeri':9A,49B,78C 'forgery.this':96C 'host':27B 'issu':97C 'let':10A 'log':57B 'logged-in':56B 'make':69B 'malici':63B 'n/a':106C 'packag':24B 'page':64B 'pattern':86C,102C 'plugin':4A,40B 'request':8A,48B,77C,95C 'self':26B 'self-host':25B 'site':7A,47B,73B,76C,94C 'superb':2A,22A,29B,34B,83C,90C,99C 'superb-block':28B,89C 'superb-blocks':21A 'suplugin':82C 'theme':38B,87C,103C 'trick':67B 'version':52B 'visit':61B 'vulner':80C 'woocommerc':31B 'wordpress':1A,32B,42B","nicknames":[],"mitigations":[],"who_affected":"Sites running Superb Addons 4.0.0 through 4.2.4 with WooCommerce active are exposed. The Add to Cart block's public REST endpoint superbaddons/commerce/nonce returns a valid REST nonce for any logged-in visitor to a page the attacker controls, so an admin who visits that page can have requests made as them, including creating a new administrator account. It needs the admin's browser to send site cookies on cross-site requests. Sites without WooCommerce or without the plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T09:49:25Z","by":"analyst","doc":"https://en-gb.wordpress.org/plugins/superb-blocks/","run_id":2094}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["superbblocks"],"ptokens":["blocks","superb"],"labels":["high","package","selfhosted","superbblocks","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-2026':16A,19A '-66669':17A,20A 'act':12A 'addon':3A 'admin':14A 'attack':11A 'blocks':23A 'cross':6A 'cross-sit':5A 'cve':15A,18A 'forgeri':9A 'let':10A 'plugin':4A 'request':8A 'site':7A 'superb':2A,22A 'superb-blocks':21A 'wordpress':1A","search_b":"'4.2.4':54B 'addon':35B 'administr':59B 'affect':51B 'block':30B,36B 'chang':70B 'cross':46B 'cross-sit':45B 'design':39B 'flaw':50B 'forgeri':49B 'host':27B 'log':57B 'logged-in':56B 'make':69B 'malici':63B 'packag':24B 'page':64B 'plugin':40B 'request':48B 'self':26B 'self-host':25B 'site':47B,73B 'superb':29B,34B 'superb-block':28B 'theme':38B 'trick':67B 'version':52B 'visit':61B 'woocommerc':31B 'wordpress':32B,42B","search_c":"'4.2.4':108C 'addon':84C,100C 'affect':98C 'allow':92C 'block':85C,91C,101C 'cross':75C,93C 'cross-sit':74C 'csrf':79C 'design':88C,104C 'forgeri':78C 'forgery.this':96C 'issu':97C 'n/a':106C 'pattern':86C,102C 'request':77C,95C 'site':76C,94C 'superb':83C,90C,99C 'superb-block':89C 'suplugin':82C 'theme':87C,103C 'vulner':80C","first_public_at":"2026-11-07T09:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66669","severity":null,"published_at":"2026-11-07T09:17:16+00:00","modified_at":"2026-11-07T09:17:16+00:00","first_seen_at":"2026-11-07T09:46:25+00:00","fetched_at":"2026-11-07T09:46:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-66669:2094","url":"https://en-gb.wordpress.org/plugins/superb-blocks/","severity":null,"published_at":"2026-11-07T09:49:25+00:00","modified_at":"2026-11-07T09:49:25+00:00","first_seen_at":"2026-11-07T09:49:25+00:00","fetched_at":"2026-11-07T09:49:25+00:00","note":"Fix 4.2.5 from wordpress.org changelog (vendor: Add to Cart block security fix when WooCommerce active). Endpoint/affected range from WPSec WPSEC-2026-2238 (third party; does not cite the CVE id, matched by CSRF, <=4.2.4 and 4.2.5 fix, not confirmed). No exploitation or PoC found; NVD CVSS 8.8 (Patchstack) vs WPSec 7.5 AC:H.","cites":["https://en-gb.wordpress.org/plugins/superb-blocks/","https://wpsec.com/vuln/WPSEC-2026-2238/"]}],"documents":[{"id":94599,"url":"https://en-gb.wordpress.org/plugins/superb-blocks/","title":"Superb Addons plugin page and changelog (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":"4.2.5: Security fix in the Add to Cart block's request handling when WooCommerce is active. Stable version 4.2.5.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":94600,"url":"https://wpsec.com/vuln/WPSEC-2026-2238/","title":"WPSEC-2026-2238: Superb Addons <= 4.2.4 CSRF via REST nonce exposure in commerce/nonce","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}