4.3
Moyenne
CVE-2026-2633 The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions…
Description
The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor 3.6 | premières → 3.6.1 | Pas de correctif indiqué |
Autres CVE de Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Les 30 CVE de Kadence Blocks — Page Builder Toolkit for Gutenberg Editor →
CVE-2026-104762
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site…
6.4
Moyenne
CVE-2026-18062
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site…
6.4
Moyenne
CVE-2026-18435
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site…
6.4
Moyenne
CVE-2026-15286
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized…
4.3
Moyenne