Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the `upload_files` capability in the `process_pattern` REST API endpoint. This makes it possible for authenticated attackers, with contributor level access and above, to upload images to the WordPress Media Library by supplying remote image URLs that the server downloads and creates as media attachments.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-04 | 1 | Disclosure1 |
| 2026-04-10 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-2826-kadence-blocks-version-3-6-3-medium-vulnerability-proof-of-concept CVE-2026-2826 #WordPress plugin #vulnerability kadence-blocks #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The content supplies a proof‑of‑concept for CVE‑2026‑2826 against the Kadence Blocks WordPress plugin, with no evidence of active exploitation or patches offered.
CVE-2026-2826 The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. T… https://www.cve.org/CVERecord?id=CVE-2026-2826
Post summary
A disclosure of an authorization bypass vulnerability affecting Kadence Blocks WordPress plugin versions up to 3.6.3.