EUVD-2026-42795
GHSA-4969-3qm4-pr7h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
REST API vector confirms AV:N; Contributor account required confirms PR:L; impact is integrity-only content publication with no confidentiality or availability effect.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gutenberg Blocks with AI by Kadence WP - Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured capability check on the 'get_items_permission_check' function permission callback of the 'process_pattern' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create and immediately publish posts of any type (including pages), bypassing the standard WordPress review workflow where contributors must submit posts for administrator approval.
AnalysisAI
Unauthorized post publication in Kadence Blocks (Gutenberg Blocks with AI by Kadence WP) versions up to and including 3.5.32 allows authenticated WordPress contributors to immediately publish posts, pages, and custom post types - entirely bypassing the platform's standard contributor review workflow. The flaw stems from a misconfigured capability check in the get_items_permission_check permission callback on the process_pattern REST API endpoint (CWE-863: Incorrect Authorization). No active exploitation is confirmed via CISA KEV, no public POC has been identified, and the CVSS score of 4.3 reflects a limited integrity-only impact with no confidentiality or availability consequences.
Technical ContextAI
The vulnerability resides in the Kadence Blocks WordPress plugin's REST API layer, specifically in the process_pattern endpoint defined in class-kadence-blocks-prebuilt-library-rest-api.php (lines ~590 and ~925 per NVD references). WordPress REST API endpoints register permission callbacks - functions that run before the endpoint logic to authorize the request. Here, get_items_permission_check is the callback, and it is misconfigured: it likely verifies that the user is logged in and holds at minimum the Contributor role, but it fails to enforce the WordPress capability required for direct post publication (typically publish_posts, restricted to Authors and above). This is a textbook CWE-863 (Incorrect Authorization) failure - the identity check is correct, but the privilege boundary is wrong. The result is that the authorization gate permits Contributors to invoke publication logic that the core WordPress model explicitly reserves for higher-privilege roles.
RemediationAI
Update the Kadence Blocks plugin to version 3.5.33 or later; the fix is confirmed present in SVN changeset 3445125 at plugins.trac.wordpress.org/changeset/3445125/ and is available via the standard WordPress plugin update mechanism (Dashboard > Plugins > Update Available). If an immediate update is not possible, a targeted compensating control is to audit and revoke all Contributor-level accounts that are not explicitly trusted - particularly on sites with open user registration - since this blocks the only confirmed exploitation path (PR:L). Disabling the Kadence Blocks plugin entirely is an option where its page-builder functionality is non-critical, with the trade-off of losing all plugin-provided blocks and pre-built library access. There is no indication that the REST API endpoint can be disabled in isolation without modifying plugin code. The Wordfence advisory (wordfence.com/threat-intel/vulnerabilities/id/6e739eb4-6b8b-4bc7-a1e6-790180668c93) should be consulted for any additional vendor guidance.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today