Kadence Blocks Page Builder Toolkit For Gutenberg Editor CVE-2026-2826

The CVSS score of 4.3 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects a low-severity network-accessible vulnerability requiring low privilege (authenticated contributor) with no user interaction. The moderate CVSS score is anchored primarily by the integrity impact (uploading unauthorized media) rather than confidentiality or availability concerns. However, real-world risk depends on deployment context: on multi-author WordPress installations where contributors are common, this becomes a meaningful privilege escalation vector enabling unauthorized media uploads that could clutter the library, create storage issues, or facilitate subtle supply-chain attacks if uploaded files are later used in site content. The attack is trivially automatable with standard REST API calls. No KEV status, EPSS probability, or POC references were provided, but the straightforward nature of the vulnerability (missing authorization check in a REST endpoint) combined with REST API accessibility suggests exploitation is likely if this plugin is widely deployed on contributor-enabled sites. Organizations with strict least-privilege policies limiting contributor access may see minimal impact; those with many authors face moderate risk.

An authenticated WordPress contributor on a multi-author site makes a REST API POST request to the process_pattern endpoint with a malicious remote image URL (e.g., pointing to a large file or an image embedded with metadata). The server downloads the image and creates a media attachment without verifying the contributor has the upload_files capability. The attacker successfully adds unauthorized media to the library, consuming storage or polluting the media catalog. No user interaction is required and the attack succeeds in seconds via standard REST tooling.