PT-2026-30315 · WordPress · Kadence Blocks — Page Builder Toolkit For Gutenberg Editor

Lukasz Sobanski · Published 2026-04-04 · Updated 2026-04-04 · CVE-2026-2826

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress versions up to and including 3.6.3

Description The Kadence Blocks plugin for WordPress does not properly verify the upload files capability for users accessing the process pattern API endpoint. This allows authenticated attackers with contributor-level access or higher to upload images to the WordPress Media Library by providing remote image URLs, which the server then downloads and creates as media attachments.

Recommendations Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress to a version later than 3.6.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2826

Affected Products

Kadence Blocks — Page Builder Toolkit For Gutenberg Editor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-2826 · Security Note
• https://twitter.com/CVEnew/status/2040481242228171262 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5f91df7e-5d9d-4a3a-9afc-d771106a0be6?source=cve · Note
• https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.6.4/includes/class-kadence-blocks-prebuilt-library-rest-api.php#L1224 · Note