CVE-2026-12902: Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create arbitrary Media Library attachments by downloading remote images to the site's uploads directory via wpuploadbits() and wpinsertattachment(), bypassing the uploadfiles capability boundary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kadence Blocks (Page Builder Toolkit for Gutenberg Editor)to a version that resolves this vulnerability.Fixed in 3.7.7 - Compensating control
Restrict or revoke contributor+ access (who can reach authenticated AJAX endpoints) until Kadence Blocks is upgraded beyond 3.7.7, since authenticated attackers with Contributor+ can create arbitrary Media Library attachments.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12902?
The severity of CVE-2026-12902 is rated as medium with a CVSS score of 4.3.
What is CVE-2026-12902 about?
CVE-2026-12902 describes an authorization bypass vulnerability in Kadence Blocks versions up to 3.7.7, allowing unauthorized media attachment creation.
Who is affected by CVE-2026-12902?
CVE-2026-12902 affects users of the Kadence Blocks plugin for WordPress who have versions 3.7.7 or lower.
How do I fix CVE-2026-12902?
To fix CVE-2026-12902, update the Kadence Blocks plugin to the latest version that addresses the authorization issue.
What actions can be exploited due to CVE-2026-12902?
CVE-2026-12902 allows authenticated users to create arbitrary media attachments without proper authorization.