Kadence Blocks CVE-2026-11357

Exploitation requires: (1) the attacker holds an authenticated WordPress account at Contributor level or higher - unauthenticated exploitation is not possible; (2) an administrator has previously connected a valid Kadence Pro license to the site, populating the stored credential options that the plugin serializes; (3) the attacker has access to the WordPress block editor, which Contributor-level users have by default. Exploitation is limited by: the Contributor authentication prerequisite (eliminates anonymous internet attackers), the requirement that an active Kadence Pro license is configured (free/unlicensed installations expose no sensitive credentials), and the fact that credential extraction occurs entirely in the browser client-side requiring no HTTP request manipulation. The attack does not work against sites using only the free version of Kadence Blocks without a connected Pro license.

The NVD-assigned CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the moderate severity. The network attack vector is correct because exploitation occurs entirely via the browser without requiring local system access. PR:L appropriately reflects the Contributor-level authentication requirement. The confidentiality impact is limited (C:L) because only Kadence license credentials are exposed, not WordPress database secrets or user PII directly. No EPSS score was provided in the intelligence sources, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation. The real-world risk is contextually elevated above the raw score if the license key or api_key can be used to access Kadence's external API, clone license entitlements, or enumerate the site's registered domain - however, that downstream API abuse potential is not confirmed in the available data. Sites with a large contributor user base, client-access portals, or multi-author blogs present a meaningfully higher exposure surface than single-author installations.

A threat actor who holds a Contributor account on the target WordPress site - obtained via registration, credential stuffing, or social engineering - logs into the WordPress admin panel, opens the block editor on any post or page, and opens the browser developer console. The attacker types window.kadence_blocks_params.proData and immediately receives the full license key, api_key, owner email, and registered domain in plaintext. No specialized tooling, network interception, or server-side exploitation is required. No public exploit code has been identified at time of analysis, but the technique requires only basic browser developer tools knowledge.