What the vulnerability does
01Description
The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_and_ext_json function. This is due to a flawed strpos() substring check that only verifies whether the filename contains the string '.json' rather than confirming the filename ends with a .json extension, allowing double-extension filenames like shell.json.php to bypass validation. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible.
Explanation of Vulnerability in Simple Terms
02Summary
GutenBee allows authenticated users to upload files without proper validation, enabling them to upload malicious files to the site. An attacker with low-level access can exploit this to upload executable code or other dangerous files. This affects all versions up to 2.20.1. Update to a version newer than 2.20.1 to resolve the issue.
What an attacker can do
03Attacker Capabilities
Upload malicious files (code, executables) to the site and potentially run them.
Potential impact on your site
04Site Impact
Malicious files uploaded to your site could compromise your WordPress installation and visitor data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-level user account (subscriber or contributor role or higher).
Key dates
06Disclosure timeline
May 28, 2026
CVE published
May 28, 2026
Record updated
