Kadence Blocks CVE-2026-66696

Exploitation requires an authenticated WordPress user account with at least Contributor-level role (CVSS PR:L). The Gutenberg Blocks by Kadence Blocks plugin must be installed and active on the target site at version 3.7.8 or earlier. Sites that do not allow open user registration or that have no untrusted Contributor-level accounts are not realistically exploitable. The limitation is the mandatory authenticated access - unauthenticated visitors cannot trigger this vulnerability. No specific non-default configuration setting is mentioned in the available data as required beyond having the plugin installed.

The CVSS base score of 4.3 reflects a genuinely limited threat: the attack vector is network (AV:N), complexity is low (AC:L), but privileges required are low (PR:L) - meaning a Contributor account is mandatory. This substantially limits the realistic attacker pool to insiders, registered community members, or scenarios where attacker-controlled accounts already exist on the target site. No EPSS score was provided in the available intelligence. The vulnerability is not listed in CISA KEV and no public POC has been identified, further reducing urgency. The scope is unscoped (S:U) with only low confidentiality impact (C:L) and zero integrity or availability impact (I:N/A:N). Overall this is a real but low-priority finding - the CVSS score accurately reflects limited real-world risk, not a case of high-CVSS overstating exposure.

An attacker registers or compromises a Contributor-level account on a target WordPress site running Kadence Blocks <= 3.7.8. They interact with a specific block or plugin API endpoint that returns a response payload containing sensitive fields not filtered by the plugin's permission check. No public exploit code has been identified, but the low complexity (AC:L) and standard HTTP vector mean exploitation would be straightforward once the specific endpoint is identified.