{"id":"CVE-2026-66669","published":"2026-11-07T09:17:16.063","lastModified":"2026-11-07T19:17:29.323","description":"Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/superb-blocks/vulnerability/wordpress-superb-addons-blocks-patterns-amp-theme-designer-plugin-4-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A CSRF vulnerability in the Suplugins Superb Addons plugin (versions through 4.2.4) allows attackers to trick authenticated administrators into performing unintended actions, such as modifying theme settings or injecting malicious content, by exploiting the lack of anti-CSRF tokens in sensitive requests.","exploitability":"Exploitation requires social engineering to诱导 a logged-in administrator with sufficient privileges to visit a malicious page that triggers forged requests; no authentication bypass or complex conditions are needed beyond user interaction.","blast_radius":"Successful exploitation could lead to full compromise of the WordPress site, including unauthorized theme modifications, insertion of backdoor patterns, or defacement, depending on the capabilities exposed by the vulnerable endpoints.","remediation":"Upgrade to Superb Addons version 4.2.5 or later, which includes CSRF token enforcement for all state-changing requests.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","web","wordpress","plugin","high-severity"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:53:20.710Z"}}