CVE-2026-2826: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the uploadfiles capability in the processpattern REST API endpoint. This makes it possible for authenticated attackers, with contributor level access and above, to upload images to the WordPress Media Library by supplying remote image URLs that the server downloads and creates as media attachments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.6.3 - Compensating control
Restrict access to the Kadence Blocks REST API endpoint that processes media patterns (the process_pattern endpoint) so only users with the `upload_files` capability can invoke it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2826?
CVE-2026-2826 is classified as a high severity vulnerability due to the potential for unauthorized media uploads.
How do I fix CVE-2026-2826?
To fix CVE-2026-2826, update the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin to version 3.6.4 or later.
Who is affected by CVE-2026-2826?
All users of Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin versions up to and including 3.6.3 are affected by CVE-2026-2826.
What kind of attack does CVE-2026-2826 allow?
CVE-2026-2826 allows authenticated users with Contributor roles or higher to upload media without proper authorization.
Is CVE-2026-2826 a zero-day vulnerability?
No, CVE-2026-2826 is not a zero-day vulnerability as it has been publicly disclosed and a patch is available.