PT-2026-44209 · WordPress · Gutenbee

Athiwat Tiprasaharn · Published 2026-05-28 · Updated 2026-05-29 · CVE-2026-9227

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GutenBee – Gutenberg Blocks versions prior to 2.20.2

Description The plugin is subject to arbitrary file upload due to a flawed substring check in the gutenbee file and ext json() function. The strpos() function only verifies if the filename contains the string '.json' instead of ensuring the file ends with that extension. This allows authenticated attackers with author-level access or higher to bypass validation using double-extension filenames, such as 'shell.json.php', to upload executable files and achieve remote code execution.

Recommendations Update to a version newer than 2.20.1.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-9227

Affected Products

Gutenbee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9227.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-9227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9227 · Security Note
• https://github.com/cssigniter/gutenbee/commit/bde934cdecf67a4de1d6548cc1fc6c59bc6690e5 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L570 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2d20e8c9-975d-4e8c-8bea-50935853c7d4?source=cve · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L571 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L570 · Note
• https://twitter.com/ADKCyber/status/2060149917298135389 · Twitter Post
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L579 · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L579 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3543574%40gutenbee&new=3543574%40gutenbee&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L571 · Note