---
id: "CVE-2026-66669"
page: "https://infrastack.ai/live/CVE-2026-66669"
kind: "vulnerability"
aliases: ["CVE-2026-66669"]
title: "WordPress Superb Addons plugin: cross-site request forgery lets attackers act as admins"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "superb-blocks", "fixed": ["4.2.5"], "affected": ">= 4.0.0, <= 4.2.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "superb-blocks", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "woocommerce-not-active"]
published_at: "2026-11-07T09:17:16+00:00"
first_seen_at: "2026-11-07T09:46:25+00:00"
updated_at: "2026-11-07T09:49:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66669", "first_seen_at": "2026-11-07T09:46:25+00:00"}, {"source": "analyst", "url": "https://wpsec.com/vuln/WPSEC-2026-2238/", "first_seen_at": "2026-11-07T09:49:25+00:00", "cites": ["https://wpsec.com/vuln/WPSEC-2026-2238/", "https://en-gb.wordpress.org/plugins/superb-blocks/"]}]
exploit_sources: []
---

# WordPress Superb Addons plugin: cross-site request forgery lets attackers act as admins

Link for people: https://infrastack.ai/live/CVE-2026-66669 (this .md is for agents)

The Superb Addons block and theme designer plugin for WordPress has a cross-site request forgery flaw, affecting versions through 4.2.4. A logged-in administrator who visits a malicious page can be tricked into making changes on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:superb-blocks affected >= 4.0.0, <= 4.2.4 fixed 4.2.5

## How to check

In WordPress admin > Plugins, check the Superb Addons (superb-blocks) version; 4.2.4 or earlier (from 4.0.0) is vulnerable. Also check that WooCommerce is active: the vulnerable endpoint /wp-json/superbaddons/commerce/nonce exists only then. Without WooCommerce the endpoint is not registered.

## Fix

Update Superb Addons (superb-blocks) to 4.2.5 or later.

## Timeline

- 2026-11-07T09:46:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66669
- 2026-11-07T09:49:25+00:00 analyst https://wpsec.com/vuln/WPSEC-2026-2238/ — Fix 4.2.5 from wordpress.org changelog (vendor: Add to Cart block security fix when WooCommerce active). Endpoint/affected range from WPSec WPSEC-2026-2238 (third party; does not cite the CVE id, matched by CSRF, <=4.2.4 and 4.2.5 fix, not confirmed). No exploitation or PoC found; NVD CVSS 8.8 (Patchstack) vs WPSec 7.5 AC:H.

## Documents

- [describes] WPSEC-2026-2238: Superb Addons <= 4.2.4 CSRF via REST nonce exposure in commerce/nonce https://wpsec.com/vuln/WPSEC-2026-2238/
- [fix] Superb Addons plugin page and changelog (wordpress.org) https://en-gb.wordpress.org/plugins/superb-blocks/

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns &amp; Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns &amp; Theme Designer: from n/a through 4.2.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_