EUVD-2026-40895
GHSA-cpmr-m3wg-cf9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor WordPress account
-
DeliveryIdentify Kadence Blocks prebuilt-library AJAX action
-
ExploitCraft request with attacker-controlled remote image URL
-
ExecutionServer fetches remote image via wp_upload_bits() bypassing capability check
-
ImpactAttachment inserted into Media Library via wp_insert_attachment()
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress account with at minimum contributor-level role on the target installation. The Kadence Blocks plugin must be installed and active. The attack targets specific AJAX endpoint handlers within the prebuilt-library class at lines approximately 817, 916, 1078, and 1223 of class-kadence-blocks-prebuilt-library.php. Exploitation is limited to fetching and storing remote-URL-sourced image content - it does not permit direct upload of arbitrary attacker-supplied file bytes, and is confined to the uploads directory. Sites with no contributor-level (or higher) accounts accessible to untrusted parties are not at meaningful risk. There is no user-interaction requirement (UI:N) and no complex precondition beyond account possession (AC:L). |
| Impact | The NVD-assigned CVSS 3.1 score of 4.3 (Medium) reflects AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - network-reachable, low-complexity, low-privilege exploitation with a limited integrity impact and no confidentiality or availability effect. Real-world risk aligns closely with this moderate rating: the barrier to exploitation is possession of a contributor account, which is non-trivial on tightly managed sites but trivially achievable on any site that allows open user registration or has multiple content editors. The upload bypass is constrained to remote-URL image fetching - it does not provide arbitrary file write of attacker-controlled content (the content originates from a remote URL, not a direct upload stream), limiting the immediate damage potential. No EPSS data was supplied; given the absence of KEV listing and no identified public exploit code, opportunistic mass exploitation is unlikely at present, though the low attack complexity means exploitation is straightforward once an account is obtained. The risk is highest for WordPress multi-author or community sites where contributor accounts are distributed broadly. |
| Exploit ScenarioDerived | An attacker who holds or obtains a contributor-level WordPress account on a target site sends a crafted AJAX request to the Kadence Blocks prebuilt-library endpoint, supplying an attacker-controlled remote image URL. Because the handler invokes wp_upload_bits() and wp_insert_attachment() without a capability check, the remote image is downloaded to the site's uploads directory and registered in the Media Library - actions that should require the upload_files capability the contributor does not possess. The technique can be used to stage additional content, pollute the Media Library, or potentially serve attacker-controlled imagery from the target domain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Authorization bypass in the Kadence Blocks WordPress plugin (all versions through 3.7.7) allows authenticated contributors to create arbitrary Media Library attachments by fetching remote images via internal WordPress functions, bypassing the upload_files capability boundary. The flaw resides in class-kadence-blocks-prebuilt-library.php at multiple call sites where wp_upload_bits() and wp_insert_attachment() are invoked without verifying the requesting user's authorization. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress.org changeset 3590217 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3590217%40kadence-blocks&new=3590217%40kadence-blocks) reflects the corrective code change, but an explicit fixed release version was not provided in the available intelligence. Site administrators should update the Kadence Blocks plugin to the latest available version from the WordPress plugin repository immediately and verify the installed version exceeds 3.7.7. As a compensating control where immediate patching is not feasible, restrict contributor account creation and audit existing contributor-level users - this directly limits the exploitation pool since PR:L is a hard prerequisite. Alternatively, a WAF rule blocking access to the specific prebuilt-library AJAX actions can prevent unapproved remote image fetches, though this may impair the plugin's design library import feature. Review the Media Library for unexpected attachment entries as an indicator of prior exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code lives in the plugin's prebuilt-library class (class-kadence-blocks-prebuilt-library.php), which powers Kadence Blocks' design library import workflow inside the WordPress Gutenberg editor. WordPress enforces a role-capability model where the upload_files capability governs Media Library write access; contributors lack it by default. CWE-862 (Missing Authorization) describes the root cause: the plugin's AJAX handlers that invoke wp_upload_bits() and wp_insert_attachment() perform no capability_check or current_user_can('upload_files') guard before executing. The CPE string (cpe:2.3:a:stellarwp:kadence_blocks_-_page_builder_toolkit_for_gutenberg_editor:*:*:*:*:*:*:*:*) covers all StellarWP-distributed versions of the plugin. This class of flaw is common in WordPress plugins that expose AJAX endpoints for editor-facing features without mirroring the underlying capability checks WordPress core would normally enforce.
Know when Kadence Blocks Page Builder Toolkit For Gutenberg Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Contributor account required (PR:L); network-delivered with no complexity; integrity-only impact via unauthorized Media Library write; no confidentiality or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Kadence Blocks - Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create arbitrary Media Library attachments by downloading remote images to the site's uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassing the upload_files capability boundary.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Kadence Blocks Plugin IDOR and Authorization Bypass
View all 2Stored cross-site scripting in the Kadence Blocks - Page Builder Toolkit for Gutenberg Editor WordPress plugin affects a
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated con
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated con
Sensitive information exposure in Kadence Blocks (WordPress plugin) versions up to and including 3.7.5 allows authentica
Kadence Blocks Page Builder Toolkit for Gutenberg Editor plugin for WordPress allows authenticated contributors to bypas
Exploit-DB