What is the CVSS score of CVE-2026-9227?

CVE-2026-9227 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-9227?

GutenBee - Gutenberg Blocks WordPress plugin (versions through 2.20.1) contains a remote code execution vulnerability exploitable by authenticated users with Author-level permissions or higher…

How to fix or mitigate CVE-2026-9227?

Within 24 hours: Audit all user accounts with Author role or higher and review file upload logs for suspicious .json.php or double-extension files; disable the GutenBee plugin if business operations permit. Within 7 days: If the plugin must remain enabled, restrict Author/Editor/Administrator role assignments to a minimal trusted set and implement file upload restrictions via WordPress security controls to block PHP and double-extension uploads. Within 30 days: Monitor GutenBee vendor advisories for a patched version and evaluate alternative Gutenberg block solutions.

PHP CVE-2026-9227

EUVD-2026-32732 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-28 Wordfence

GHSA-fxjg-wrwj-m45j

File Upload RCE PHP WordPress

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 28, 2026 - 07:50 vuln.today

Analysis Generated

May 28, 2026 - 07:50 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

HIGH 8.8

DescriptionCVE.org

The GutenBee - Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_and_ext_json function. This is due to a flawed strpos() substring check that only verifies whether the filename contains the string '.json' rather than confirming the filename ends with a .json extension, allowing double-extension filenames like shell.json.php to bypass validation. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible.

AnalysisAI

Arbitrary file upload leading to remote code execution affects the GutenBee – Gutenberg Blocks WordPress plugin in all versions through 2.20.1, enabling authenticated users with Author role or higher to upload PHP files disguised with double extensions such as shell.json.php. The flaw stems from a permissive strpos() substring check in gutenbee_file_and_ext_json that allows attackers to bypass WordPress filetype validation and execute arbitrary PHP on the server. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.