What is the CVSS score of EUVD-2026-53903?

EUVD-2026-53903 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Kadence Blocks EUVD-2026-53903

| CVE-2026-66696 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-08-06 Patchstack

GHSA-pfhc-6c7h-5cc4

WordPress Information Disclosure Wordpress Plugin Gutenberg Blocks By Kadence Blocks Nexcess

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via standard HTTP; requires low-privilege Contributor account; only partial confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:03 vuln.today

DescriptionCVE.org

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.

AnalysisAI

Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

Gutenberg Blocks by Kadence Blocks is a WordPress plugin (CPE: cpe:2.3:a:nexcess:gutenberg_blocks_by_kadence_blocks) that extends the WordPress block editor with additional UI components. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin includes data in API responses or block output that is sensitive but not filtered by the contributor permission tier. WordPress roles are hierarchical; Contributors can create draft posts but cannot publish or access admin-level data - yet this flaw allows them to receive sensitive fields the plugin failed to strip from its response payload. The network-accessible (AV:N) vector indicates this is reachable over standard HTTP without physical or local access.

RemediationAI

Update the Gutenberg Blocks by Kadence Blocks plugin beyond version 3.7.8. A patch is available per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-7-8-sensitive-data-exposure-vulnerability); however, the exact patched release version was not independently confirmed in the available intelligence data - verify the target version via the WordPress plugin repository or vendor changelog before upgrading. As a compensating control, site administrators can audit and demote untrusted Contributor-level accounts, or restrict Contributor registration if open registration is enabled - this removes the required PR:L prerequisite entirely. Note that blocking Contributor access may affect editorial workflows on sites with community authorship models.