The Kadence Blocks plugin for WordPress is vulnerable to an Insecure Direct Object Reference due to a mismatch between the authorization object and the accessed object in the Optimize_Rest_Controller endpoints (create_item(), get_item(), delete_item(), bulk_delete_items()). Authorization checks use current_user_can('edit_post'/'delete_post', $post_id) against a user-supplied post_id, but the storage keys analysis records by sha256($post_path), where post_path is attacker-controlled and not verified to correspond to post_id. This allows authenticated attackers with Contributor-level or higher privileges to read or delete analysis records belonging to posts owned by other users by submitting their own post_id (passing capability checks) with a victim's post_path.

Authenticated users with Contributor-level access or higher can bypass authorization controls to read or delete optimizer analysis records associated with posts they do not own. This leads to unauthorized modification or disclosure of data related to other users' posts. The vulnerability does not impact confidentiality of the post content itself, nor does it affect availability beyond the analysis records. The CVSS score of 4.3 reflects limited impact confined to integrity of analysis data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict Contributor-level and higher user access carefully and monitor for suspicious activity related to optimizer analysis records. Avoid relying solely on post_id-based authorization checks without verifying consistency with post_path or other keys.