CVE-2026-2633

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2633", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-17T17:42:46.510Z", "datePublished": "2026-02-18T06:42:42.888Z", "dateUpdated": "2026-04-08T17:11:22.271Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:22.271Z"}, "affected": [{"vendor": "stellarwp", "product": "Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files."}], "title": "Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c06e0a9-a13a-4cee-a1a5-c43c114b2dbf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L789"}, {"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L1177"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3454881%40kadence-blocks%2Ftrunk&old=3453204%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ali S\u00fcnb\u00fcl"}], "timeline": [{"time": "2026-02-03T19:20:21.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-17T17:43:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T14:19:51.901936Z", "id": "CVE-2026-2633", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T14:20:06.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2633", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T14:19:51.901936Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T14:19:57.025Z"}}], "cna": {"title": "Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload", "credits": [{"lang": "en", "type": "finder", "value": "Ali S\u00fcnb\u00fcl"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "stellarwp", "product": "Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T19:20:21.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-17T17:43:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c06e0a9-a13a-4cee-a1a5-c43c114b2dbf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L789"}, {"url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L1177"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3454881%40kadence-blocks%2Ftrunk&old=3453204%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-18T06:42:42.888Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2633", "state": "PUBLISHED", "dateUpdated": "2026-02-18T14:20:06.984Z", "dateReserved": "2026-02-17T17:42:46.510Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T06:42:42.888Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor", "vendor": "stellarwp", "versions": [{"lessThanOrEqual": "3.6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files."}, {"lang": "es", "value": "El plugin Gutenberg Blocks with AI by Kadence WP para WordPress es vulnerable a una autorizaci\u00f3n faltante en todas las versiones hasta la 3.6.1, inclusive. Esto se debe a una verificaci\u00f3n de capacidad faltante en la funci\u00f3n `process_image_data_ajax_callback()` que maneja la acci\u00f3n AJAX `kadence_import_process_image_data`. La verificaci\u00f3n de autorizaci\u00f3n de la funci\u00f3n a trav\u00e9s de `verify_ajax_call()` solo valida la capacidad `edit_posts` pero no verifica la capacidad `upload_files`. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, carguen im\u00e1genes arbitrarias desde URLs remotas a la biblioteca de medios de WordPress, eludiendo la restricci\u00f3n de capacidad est\u00e1ndar de WordPress que impide a los Colaboradores cargar archivos."}], "id": "CVE-2026-2633", "lastModified": "2026-06-17T10:31:26.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2633", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T14:19:51.901936Z", "version": "2.0.3"}}]}, "published": "2026-02-18T07:16:10.807", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L1177"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L789"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3454881%40kadence-blocks%2Ftrunk&old=3453204%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c06e0a9-a13a-4cee-a1a5-c43c114b2dbf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.6.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor", "source": "cna", "vendor": "stellarwp"}, "product": "kadence_blocks_\u2014_page_builder_toolkit_for_gutenberg_editor", "vendor": "stellarwp"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:22:51.094083+00:00", "value": {"mitigation_remediation": ["Upgrade Kadence Blocks to the latest available release (typically 3.6.2 or newer) to include the missing capability check.", "If the image import feature is unnecessary, completely disable the 'kadence_import_process_image_data' AJAX action by removing the associated function from the plugin or by applying a custom filter to block the action.", "Audit the plugin\u2019s code for similar missing capability checks, particularly around functions that manipulate media files, and ensure that 'upload_files' is always required for upload-related actions."], "summary": {"action": "Apply Patch", "impact": "Unauthorized media uploads by authenticated Contributor+ users"}, "threat_synthesis": {"affected_systems": "Kadence Blocks \u2013 Page Builder Toolkit for Gutenberg Editor, all released versions up to and including 3.6.1, which are installed on WordPress sites.", "description_and_impact": "The Kadence Blocks \u2013 Page Builder Toolkit for Gutenberg Editor plugin for WordPress contains a missing capability check in the AJAX handler that processes image data. The handler verifies only that the user has the capability to edit posts and fails to verify that the user is allowed to upload files. As a result, any authenticated user with Contributor or higher capabilities can trigger the AJAX action to import images from remote URLs into the WordPress Media Library without the standard permission checks. This flaw does not allow direct code execution but permits misuse of the media upload functionality, potentially compromising the integrity of the media repository.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is not listed in the KEV catalog. Exploitation requires an authenticated account with Contributor or higher capability, so the risk is limited to sites that already have such user roles. Even though no remote code execution or privilege escalation is possible, repeated unauthorized uploads could affect media integrity and availability."}}}}, "created": "2026-02-18T10:32:35.426802+00:00", "updated": "2026-04-15T20:30:13.776356+00:00", "vendors": ["stellarwp", "stellarwp$PRODUCT$kadence_blocks_\u2014_page_builder_toolkit_for_gutenberg_editor", "wordpress", "wordpress$PRODUCT$wordpress"]}