What is the CVSS score of CVE-2026-12902?

CVE-2026-12902 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Kadence Blocks CVE-2026-12902

EUVD-2026-40895 MEDIUM

Missing Authorization (CWE-862)

2026-07-01 Wordfence

GHSA-cpmr-m3wg-cf9c

WordPress Authentication Bypass Kadence Blocks Page Builder Toolkit For Gutenberg Editor Wordpress Plugin Stellarwp

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Contributor account required (PR:L); network-delivered with no complexity; integrity-only impact via unauthorized Media Library write; no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:30 vuln.today

CVE Published

Jul 01, 2026 - 03:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create arbitrary Media Library attachments by downloading remote images to the site's uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassing the upload_files capability boundary.

AnalysisAI

Authorization bypass in the Kadence Blocks WordPress plugin (all versions through 3.7.7) allows authenticated contributors to create arbitrary Media Library attachments by fetching remote images via internal WordPress functions, bypassing the upload_files capability boundary. The flaw resides in class-kadence-blocks-prebuilt-library.php at multiple call sites where wp_upload_bits() and wp_insert_attachment() are invoked without verifying the requesting user's authorization. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected code lives in the plugin's prebuilt-library class (class-kadence-blocks-prebuilt-library.php), which powers Kadence Blocks' design library import workflow inside the WordPress Gutenberg editor. WordPress enforces a role-capability model where the upload_files capability governs Media Library write access; contributors lack it by default. CWE-862 (Missing Authorization) describes the root cause: the plugin's AJAX handlers that invoke wp_upload_bits() and wp_insert_attachment() perform no capability_check or current_user_can('upload_files') guard before executing. The CPE string (cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor:*:*:*:*:*:*:*:*) covers all StellarWP-distributed versions of the plugin. This class of flaw is common in WordPress plugins that expose AJAX endpoints for editor-facing features without mirroring the underlying capability checks WordPress core would normally enforce.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress.org changeset 3590217 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3590217%40kadence-blocks&new=3590217%40kadence-blocks) reflects the corrective code change, but an explicit fixed release version was not provided in the available intelligence. Site administrators should update the Kadence Blocks plugin to the latest available version from the WordPress plugin repository immediately and verify the installed version exceeds 3.7.7. As a compensating control where immediate patching is not feasible, restrict contributor account creation and audit existing contributor-level users - this directly limits the exploitation pool since PR:L is a hard prerequisite. Alternatively, a WAF rule blocking access to the specific prebuilt-library AJAX actions can prevent unapproved remote image fetches, though this may impair the plugin's design library import feature. Review the Media Library for unexpected attachment entries as an indicator of prior exploitation.