The Kadence Blocks plugin contains an insecure direct object reference in its optimizer REST endpoints. The code checks that a logged‑in user has permission to edit or delete a post using the supplied post ID, but the actual data accessed is keyed by a separate "post_path" parameter that is fully controlled by the attacker. Consequently Contributor or higher capability can supply a post ID that passes the capability test and an arbitrary post_path belonging to another user, allowing that attacker to read, modify, or delete optimizer analysis records for posts that they do not own. The weakness is a classic CWE‑639 scenario involving authorization bypass via meeting an IDOR that is not correlated with the resource being accessed.

The affected product is Kadence Blocks – Page Builder Toolkit for Gutenberg Editor from StellarWP. All releases up to and including 3.7.7 Compatibility with earlier versions is not specified, but the vulnerability is limited to the .7.7 series.

The CVSS score of 4.3 indicates moderate severity, reflecting that the flaw requires the attacker to be authenticated and to possess Contributor-level rights. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. The vulnerability is exploitable through the public REST API endpoints for creating, retrieving, deleting, and bulk‑deleting optimizer items, requiring an authenticated request that contains both a valid post ID (to satisfy the authorisation check) and a malicious post_path payload. Because the attacker can force the use of a different post_path, they can target any other user’s post path.