Spectra Gutenberg Blocks CVE-2026-92294

The affected plugin (Spectra / Ultimate Addons for Gutenberg, versions up to and including 2.20.4) must be installed and active. The vulnerable '__construct' function performs insufficient file path validation, and per the CVSS vector (PR:N/UI:N) the endpoint is reachable by unauthenticated attackers against default configurations with no user interaction. The key limiting factor is scope of impact rather than preconditions: the flaw is described as 'limited file deletion' restricted to theme files, so it does not permit arbitrary-file deletion, code execution, or data disclosure; damage is confined to removing theme files (site breakage/defacement). Exploitation is further bounded to sites running a vulnerable version before the fix referenced in changeset 3736176.

This is a genuine but mid-tier priority, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity flaw with no user interaction, which normally argues for urgency; however, the impact is deliberately bounded (C:N, I:L, A:L) - CWE-862 missing authorization enabling only 'limited file deletion' of theme files, not code execution or data disclosure. The vendor-ecosystem decision label is 'this_month' rather than act_now/emergency, consistent with a serious-but-contained issue. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be stated. There is no CISA KEV listing and no confirmed public exploit code (the references are the Wordfence advisory plus WordPress plugin source/changeset links, i.e. patch evidence, not a weaponized PoC). SSVC-style signals beyond the decision label (automatable, technical impact) were not provided. One cross-source tension: the input Tags include 'Authentication Bypass', but the assigned CWE-862 (Missing Authorization) and the description describe an unauthenticated endpoint lacking an authorization check rather than a bypass of an authentication mechanism - treat the 'Authentication Bypass' label with caution. Net: reachable by anyone over the network, but the ceiling is site defacement/breakage via theme-file deletion, so prioritize for prompt patching within the month rather than as a critical incident.

An unauthenticated remote attacker sends a crafted request that reaches the plugin's vulnerable '__construct' code path, supplying a manipulated file path that the insufficient validation accepts, causing deletion of theme files on the server and breaking or defacing the affected WordPress site. The exploitation is network-based with low complexity and requires no privileges or user interaction. No verified public exploit code was identified in the provided sources at the time of analysis.