What is the CVSS score of CVE-2026-2826?

CVE-2026-2826 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-2826

EUVD-2026-18985 MEDIUM

Missing Authorization (CWE-862)

2026-04-04 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 08:45 euvd

EUVD-2026-18985

Analysis Generated

Apr 04, 2026 - 08:45 vuln.today

CVE Published

Apr 04, 2026 - 08:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the upload_files capability in the process_pattern REST API endpoint. This makes it possible for authenticated attackers, with contributor level access and above, to upload images to the WordPress Media Library by supplying remote image URLs that the server downloads and creates as media attachments.

AnalysisAI

Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypass authorization checks and upload arbitrary images to the Media Library via the process_pattern REST API endpoint. An attacker with contributor-level access or higher can supply remote image URLs that the server downloads and converts into media attachments, exploiting missing capability verification for the upload_files action. No public exploit code or active exploitation has been reported at time of analysis.

Technical ContextAI

The vulnerability exists in the REST API endpoint process_pattern within the Kadence Blocks plugin (cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor). The endpoint accepts remote image URLs and processes them server-side, downloading and creating WordPress media attachments. The root cause is improper authorization verification classified as CWE-862 (Missing Authorization), where the plugin fails to check the upload_files capability before executing the image download and attachment creation logic. This allows authenticated users with contributor privileges to perform actions typically restricted to administrators or editors, escalating their effective permissions within the WordPress media management system.

RemediationAI

Upgrade Kadence Blocks Page Builder Toolkit for Gutenberg Editor to version 3.6.4 or later, which implements proper authorization checks for the upload_files capability in the process_pattern REST API endpoint. Site administrators should update immediately via the WordPress plugin dashboard or the plugin repository at https://plugins.trac.wordpress.org/. No workarounds are available short of disabling the plugin or restricting REST API access via server-level controls. Organizations unable to update immediately should review contributor user accounts and consider temporarily restricting contributor roles until patching is complete.