PT-2026-20288 · WordPress+1 · Wordpress+1

Ali Sünbül · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-1857

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks with AI by Kadence WP plugin for WordPress versions up to and including 3.6.1

Description The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is susceptible to Server-Side Request Forgery due to inadequate validation of the endpoint parameter within the get items() function of the GetResponse REST API handler. The permission check for the endpoint parameter only requires the edit posts capability, allowing attackers with Contributor-level access or higher to make server-side requests to arbitrary endpoints on the configured GetResponse API server. This can lead to the retrieval of sensitive data, including contacts, campaigns, and mailing lists, using the site’s stored API credentials. The stored API key is also exposed in the request headers.

Recommendations Update the Gutenberg Blocks with AI by Kadence WP plugin for WordPress to a version later than 3.6.1.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-1857

Affected Products

Gutenberg Blocks With Ai

Wordpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1857 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3454881%40kadence-blocks%2Ftrunk&old=3453204%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/152292 · Telegram Post
• https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/advanced-form/getresponse-rest-api.php#L57 · Note
• https://t.me/CVEtracker/44940 · Telegram Post
• https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/advanced-form/getresponse-rest-api.php#L77 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2ea8d38a-f5ce-40dd-a015-f56d60579e05?source=cve · Note
• https://twitter.com/CVEnew/status/2024026135139356798 · Twitter Post