What is the CVSS score of CVE-2026-7465?

CVE-2026-7465 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Spectra Gutenberg Blocks are affected by CVE-2026-7465?

The Spectra Gutenberg Blocks WordPress plugin (versions ≤2.19.25) contains a remote code execution vulnerability allowing attackers with Contributor-level or higher privileges to execute arbitrary…

How to fix or mitigate CVE-2026-7465?

Within 24 hours: Audit all WordPress installations using Spectra Gutenberg Blocks plugin; identify current version via administrative interface (Settings > Plugins) and document sites running version 2.19.25 or earlier. Within 7 days: Immediately disable the plugin on all affected sites as interim mitigation, or if plugin functionality is required, restrict Contributor role to fully trusted personnel and remove plugin access for Guest/Author roles using WordPress role management. Monitor vendor security advisories for patch release. Within 30 days: Establish recurring quarterly audits of plugin versions and user role assignments; implement application-level monitoring for suspicious block rendering or PHP execution patterns.

Spectra Gutenberg Blocks CVE-2026-7465

EUVD-2026-33454 HIGH

Improper Privilege Management (CWE-269)

2026-05-30 Wordfence

GHSA-m3v7-28jh-gr9j

Privilege Escalation RCE WordPress

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 30, 2026 - 09:57 vuln.today

CVE Published

May 30, 2026 - 09:29 nvd

HIGH 8.8

DescriptionCVE.org

The Spectra Gutenberg Blocks - Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.

AnalysisAI

Remote code execution in the Spectra Gutenberg Blocks WordPress plugin (versions up to and including 2.19.25) allows authenticated users with Contributor-level access or higher to execute arbitrary PHP on the server by abusing the plugin's block rendering logic. The flaw stems from the plugin trusting attacker-controlled block attributes to register a fake uagb/-prefixed block type with an arbitrary render_callback, which is then invoked via call_user_func() when a second block of the same type is rendered in the same request. No public exploit identified at time of analysis, but the low privilege bar (Contributor is commonly granted to untrusted guest authors) makes this a high-priority issue for sites with open registration.

Technical ContextAI

Spectra (formerly Ultimate Addons for Gutenberg) by Brainstorm Force is a WordPress plugin extending the block editor with custom blocks under the uagb/ namespace. The vulnerable code lives in classes/class-uagb-init-blocks.php around lines 330-335, where the plugin processes block attributes during sequential server-side rendering. The root cause maps to CWE-269 (Improper Privilege Management) but the exploitable mechanism is dynamic callback invocation: untrusted post content can declare a block type with an arbitrary render_callback, and a subsequent block triggers call_user_func() against that callback. Because Gutenberg block content is stored as HTML comments inside post_content, any role permitted to author posts (Contributor and above) can stage the two-block payload.

RemediationAI

Upstream fix available (commits referenced in plugins.trac.wordpress.org around class-uagb-init-blocks.php lines 330-335); a released patched version is not independently confirmed from the provided data, so administrators should update Spectra / Ultimate Addons for Gutenberg to the latest version published at https://wordpress.org/plugins/ultimate-addons-for-gutenberg/ as soon as a version newer than 2.19.25 is available and consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/60013752-d7cf-46e8-84e1-1b614f737b46 for the confirmed fixed release. Until the plugin is updated, restrict Contributor and Author role assignment to trusted users only, disable open user registration (Settings → General → Membership), and consider temporarily deactivating the plugin on sites with multi-author or guest-post workflows; deactivation will break any uagb/ blocks rendered on the front end, so audit content before disabling. A Wordfence or equivalent WAF rule blocking uagb/ block payloads from non-administrators is a narrower compensating control with lower content impact.