What the vulnerability does
01Description
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create arbitrary Media Library attachments by downloading remote images to the site's uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassing the upload_files capability boundary.
Explanation of Vulnerability in Simple Terms
02Summary
Kadence Blocks versions up to 3.7.7 lack proper authorization checks on certain functions, allowing authenticated users with low privileges to modify site content they should not have access to. The vulnerability requires a valid WordPress account but no special user role. Site administrators should update to a version newer than 3.7.7 to prevent unauthorized content changes.
What an attacker can do
03Attacker Capabilities
Modify site content or settings without proper permission checks.
Potential impact on your site
04Site Impact
Unauthorized users could alter pages, posts, or plugin settings, potentially defacing content or breaking site functionality.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level privileges.
Key dates
06Disclosure timeline
July 1, 2026
CVE published
