Spectra Gutenberg Blocks CVE-2026-7465

Attacker must hold a WordPress account with Contributor-level capabilities or higher (edit_posts) on a site running Spectra Gutenberg Blocks (Ultimate Addons for Gutenberg) at version 2.19.25 or earlier with the plugin active. Exploitation requires authoring post content containing a specific two-block payload: a first uagb/-prefixed fake block that registers an attacker-chosen render_callback, and a second block of the same fake type in the same post that causes sequential block rendering to invoke call_user_func() on that callback. The condition that LIMITS exploitation is that the malicious post must actually be rendered in the same page request - typically via the Contributor's own post preview - and the site must permit Contributor-level (or higher) accounts, which is non-default on single-author sites but common on multi-author blogs, membership sites, or sites with open registration.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H aligns with the description: network-reachable, low complexity, requires low privileges (Contributor), no user interaction, and full CIA impact via PHP code execution. EPSS and CISA KEV data were not provided, so widespread exploitation cannot be confirmed; the realistic risk profile is sites that accept guest/contributor registrations or run multi-author blogs, where the PR:L bar is effectively trivial. The Wordfence disclosure indicates researcher-grade analysis but no public PoC has been linked in the provided references, so this should be treated as a credible high-priority patch rather than confirmed active exploitation. Note that the description references Spectra while the patch references and CPE point to the underlying 'ultimate-addons-for-gutenberg' plugin slug - defenders should patch by slug, not just marketing name.

An attacker registers (or is granted) a Contributor account on a target WordPress site running Spectra ≤ 2.19.25 and submits a draft post containing a crafted two-block payload: the first block registers a fake uagb/-prefixed block type whose render_callback points to a dangerous PHP function (for example, system or a plugin helper), and the second block of the same fake type triggers call_user_func() with attacker-controlled arguments when the post is previewed or rendered. Triggering preview as the Contributor - no admin review required - executes the callback in the WordPress PHP context, yielding code execution. No public exploit identified at time of analysis.