What is the CVSS score of EUVD-2026-85856?

EUVD-2026-85856 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Spectra Legacy EUVD-2026-85856

| CVE-2026-16302 MEDIUM

Information Exposure (CWE-200)

2026-09-24 Wordfence

GHSA-gp3v-wjjp-mr9p

WordPress Information Disclosure Wordpress Plugin Spectra Legacy Gutenberg Blocks Brainstormforce

4.3

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain Contributor+ account on target WordPress
Exploit

Open block editor / load editor_assets
Execution

Read Instagram token from uagb_blocks_info object
Impact

Reuse token against Instagram Graph API

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated account with Contributor-level capability or higher on a WordPress site running Spectra Legacy - Gutenberg Blocks <= 2.20.0. Exploitation is further gated on a specific deployment configuration: the separate Spectra Pro plugin must be active AND an administrator must have already linked an Instagram account (populating the uag_insta_linked_accounts option). If Spectra Pro is not installed/active or no Instagram account is linked, there is no sensitive token to disclose. No user interaction beyond the attacker's own authenticated editor access is needed, and no admin action is required at exploit time.
Impact	This is a genuine but modest-priority issue best characterized as a real-but-low-real-risk finding. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a network-reachable, low-complexity flaw requiring authenticated Contributor-level access with confidentiality-only impact rated Low. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so there is no signal of active or automated exploitation - all exploitation indicators are absent, meaning risk is targeted and opportunistic rather than widespread. The one factor that elevates practical concern above the raw C:L rating is the nature of the leaked data: raw Instagram Graph API access tokens, which are live credentials to an external service and can enable account abuse beyond the WordPress instance. However, this impact is gated behind a stacked precondition - the separate Spectra Pro plugin must be active AND an administrator must have linked an Instagram account - so the exploitable population is a subset of installs. Net: patch in normal cycles; not an emergency. No key CVSS/description conflicts exist - the network vector and Contributor auth requirement are consistent across the description and vector.
Exploit ScenarioDerived	An attacker who has (or registers/obtains) a Contributor-level account on a WordPress site running Spectra Legacy with Spectra Pro active and an admin-linked Instagram account loads the block editor and reads the uagb_blocks_info JavaScript object, which discloses the uag_insta_linked_accounts option including the raw Instagram Graph API access token. The attacker then uses that token against Instagram's Graph API to abuse the linked business account. No public exploit code is identified at time of analysis, but the extraction requires only viewing editor-served assets, so weaponization is trivial for anyone with editor access.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Authenticated WordPress users holding Contributor-level access or higher can retrieve administrator-configured Instagram Graph API access tokens from any site running the Spectra Legacy - Gutenberg Blocks plugin at version 2.20.0 or earlier, because the plugin's editor_assets function injects the uag_insta_linked_accounts option into the uagb_blocks_info JavaScript object without performing a capability check. The exposure is gated on a specific deployment state: the separate Spectra Pro plugin must be active and an administrator must already have linked an Instagram account, so sites without that integration have no token to leak and are not meaningfully at risk. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-200), this is a real but low-impact, configuration-dependent information disclosure; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).

RemediationAI

The primary fix is to update Spectra Legacy - Gutenberg Blocks past version 2.20.0; the Trac changeset https://plugins.trac.wordpress.org/changeset/3630074/ contains the upstream code change that removes the unguarded exposure of uag_insta_linked_accounts from the uagb_blocks_info payload, and the vendor advisory is at https://www.wordfence.com/threat-intel/vulnerabilities/id/eede8a1e-db33-4c07-9991-9def75dddc87?source=cve - upstream fix available (changeset/commit); the released patched version number is not independently confirmed in the provided data, so verify the plugin's current stable release before upgrading. Because the vulnerability discloses a live credential rather than merely displaying data, patching alone is insufficient: rotate or revoke the exposed Instagram Graph API token immediately after upgrading (via the Instagram/Facebook developer console and the Spectra Pro settings), since a token already harvested by a Contributor remains valid until it is invalidated. If upgrading must be deferred, the most effective compensating control is to deactivate the Spectra Pro plugin or unlink the Instagram account, which empties uag_insta_linked_accounts and eliminates the sensitive value entirely - the trade-off is loss of Instagram feed/embed functionality in the page builder. A lesser measure is to reduce the site's Contributor-and-above population and audit/reassign untrusted accounts to lower roles (Subscriber), which narrows the authenticated attack surface but does not remediate the underlying missing capability check and leaves editors of any kind able to read the token. Blocking the wp-admin editor asset endpoints or the /wp-json/ surfaces is not a workable mitigation because the data is localized into legitimate editor page loads that any contributor must be able to fetch.

Affected VersionsENISA

Spectra Legacy – Gutenberg Blocks 0 ≤2.20.0

Affected Packages

euvd spectra_legacy_gutenberg_blocks no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Spectra Legacy - Gutenberg Blocks is a WordPress page-builder plugin (formerly Ultimate Addons for Gutenberg), tracked under the CPE cpe:2.3:a:brainstormforce:spectra_legacy_-_gutenberg_blocks:*:*:*:*:*:*:*:*, and the flaw sits in its classic server-to-client data-passing pattern: the editor_assets function gathers block configuration, including the WordPress option uag_insta_linked_accounts, and emits it into the front-end/editor JavaScript object uagb_blocks_info (typically via wp_localize_script or an inline script). Because that function omits a current_user_can() capability check, any request made by a user with Contributor privileges or above receives the same localized payload that would otherwise be restricted to administrators. The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): a live credential - the raw Instagram Graph API access token persisted in the wp_options table by the companion Spectra Pro plugin's Instagram integration - is serialized to a client-accessible surface rather than being kept server-side or masked. The CVSS vector reflects this precisely: PR:L confirms the attacker must be authenticated, UI:N confirms no victim interaction is required beyond the attacker's own editor session, and C:L/c:N/i:N confirms the impact is limited to confidentiality of the token, with no direct code execution or data modification. The leaked credential is scoped to the Instagram Graph API and, depending on the token type and granted scopes, could be used to read or act on the linked Instagram business account's data until it is revoked or expired.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY MEDIUM

NVD 4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 4.3 MEDIUM

Network-reachable editor asset readable by any Contributor+ (PR:L, AC:L) with no UI; confidentiality-only leak of one linked-account token rated C:L, no integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionNVD

The Spectra Legacy - Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Medium

popular Brainstorm Force Gutenberg block suite, but impact gated on Spectra Pro add-on

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +22

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.