GutenKit EUVD-2026-70036

Exploitation requires an authenticated WordPress account with at least the Contributor role - unauthenticated visitors cannot trigger the injection. The GutenKit plugin must be installed and active on the target site. The injected CSS only reaches victims who actively load the affected post or page (UI:R), so exploitation is not fire-and-forget against passive users. JavaScript execution is explicitly not achievable at the Contributor role level, which limits the maximum impact to CSS-layer manipulation: defacement, interface redressing, and external resource loading - not session theft or credential harvesting. Sites that disable open Contributor registration, require administrator approval before publishing, or operate with a fully trusted editorial team are not realistically exposed.

The provided CVSS base score of 3.5 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N accurately reflects the constrained impact, but the PR:H metric is inconsistent with the description - the WordPress Contributor role is a low-privilege authenticated role (PR:L), and correcting this metric would push the base score modestly higher. Since JavaScript execution is not achievable at the Contributor tier, the vulnerability cannot escalate to session hijacking or credential theft, and the impact ceiling is visual manipulation of rendered pages. A publicly available proof-of-concept exists per WPScan, but no CISA KEV listing is present, confirming no documented mass or targeted exploitation at time of analysis. EPSS data was not provided. Even a mid-sized municipal IT team in leszno managing a WordPress site with open contributor registration should treat this as a meaningful but not urgent patch - the real risk is proportional to how many untrusted or externally registered Contributors have posting access, since tightly managed editorial teams effectively eliminate exploitability.

An attacker who registers or compromises a Contributor account on the target WordPress site navigates to the GutenKit block editor, inputs malicious CSS (such as overlay rules that replace UI elements with fraudulent content or hidden iframe-like constructs) into the plugin's style settings for a post, and publishes or previews it. Any visitor who subsequently loads that page receives the injected stylesheet in their browser, potentially seeing a defaced interface or unwittingly loading attacker-controlled external resources such as tracking pixels or off-site fonts. A publicly available exploit demonstrating this technique has been disclosed by WPScan.