CVE-2026-12904 is an authorization bypass vulnerability in the Kadence Blocks – Gutenberg Blocks for Page Builder Features WordPress plugin (up to version 3.7.7). The vulnerability stems from an insecure direct object reference due to inconsistent authorization checks in the Optimize_Rest_Controller's create_item(), get_item(), delete_item(), and bulk_delete_items() endpoints. Authorization is performed using current_user_can('edit_post'/'delete_post', post_id) based on a user-supplied post_id parameter, but the actual data accessed or modified is keyed by sha256(post_path), where post_path is a separate attacker-controlled parameter. Because there is no enforcement that post_path corresponds to post_id, an authenticated attacker with Contributor-level or higher privileges can access or delete analysis records belonging to other users' posts by submitting their own post_id (which passes the capability check) along with the victim's post_path.

An authenticated user with Contributor-level or higher privileges can bypass authorization controls to read or delete optimizer analysis records associated with posts owned by other users. This does not impact the confidentiality of post content itself but allows unauthorized access and deletion of analysis data related to posts, potentially affecting data integrity and availability of optimizer analysis records.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level and higher user access carefully and monitor for suspicious activity related to optimizer analysis records. Avoid exposing the vulnerable endpoints to untrusted users. Follow updates from the vendor stellarwp for an official fix or temporary mitigation.