Description
Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.
Published: 2026-11-07
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Cross Site Request Forgery
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a cross‑site request forgery in the Suplugins Superb Addons: Blocks, Patterns & Theme Designer WordPress plugin, allowing an attacker to submit requests on behalf of an authenticated user. The flaw can lead to unauthorized modifications of content or plugin settings. It is categorized as CWE‑352, indicating a failure to validate request authenticity.

Affected Systems

The Suplugins Superb Addons: Blocks, Patterns & Theme Designer plugin for WordPress, versions up to and including 4.2.4, is affected by this CSRF vulnerability. The issue was fixed in version 4.2.5 and later.

Risk and Exploitability

The CVSS score of 8.8 denotes high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The description does not provide detailed conditions for exploitation, so the exact likelihood of exploitation remains uncertain.

Generated by OpenCVE AI on November 7, 2026 at 11:05 UTC.

Remediation

Vendor Solution

Update the WordPress Superb Addons: Blocks, Patterns & Theme Designer plugin to the latest available version (at least 4.2.5).

OpenCVE Recommended Actions

  • Update the plugin to version 4.2.5 or later to remediate the CSRF vulnerability.
  • Confirm that the plugin verifies WordPress nonces or other tokens on state‑changing requests to prevent forgery.
  • Configure a web application firewall or security plugin to detect or block requests missing valid nonces or tokens.

Generated by OpenCVE AI on November 7, 2026 at 11:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 09:15:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.
Title WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-11-07T09:02:52.409Z

Reserved: 2026-07-27T14:00:48.793Z

Link: CVE-2026-66669

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-07T09:17:16.063

Modified: 2026-11-07T09:17:16.200

Link: CVE-2026-66669

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T11:15:16Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)