PT-2026-44209 · Cssigniterteam · Gutenbee – Gutenberg Blocks

Athiwat Tiprasaharn · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-9227

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee file and ext json function. This is due to a flawed strpos() substring check that only verifies whether the filename contains the string '.json' rather than confirming the filename ends with a .json extension, allowing double-extension filenames like shell.json.php to bypass validation. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-9227

Affected Products

Gutenbee – Gutenberg Blocks

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-9227 · Security Note
• https://github.com/cssigniter/gutenbee/commit/bde934cdecf67a4de1d6548cc1fc6c59bc6690e5 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L571 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L571 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2d20e8c9-975d-4e8c-8bea-50935853c7d4?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3543574%40gutenbee&new=3543574%40gutenbee&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L579 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L570 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L579 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L570 · Note