GHSA-4969-3qm4-pr7hMediumCVSS 4.3
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is...
🔗 CVE IDs covered (1)
📋 Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured capability check on the 'get_items_permission_check' function permission callback of the 'process_pattern' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create and immediately publish posts of any type (including pages), bypassing the standard WordPress review workflow where contributors must submit posts for administrator approval.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-15286
- https://plugins.trac.wordpress.org/browser/kadence-blocks/trunk/includes/class-kadence-blocks-prebuilt-library-rest-api.php#L590
- https://plugins.trac.wordpress.org/browser/kadence-blocks/trunk/includes/class-kadence-blocks-prebuilt-library-rest-api.php#L925
- https://plugins.trac.wordpress.org/changeset/3445125
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6e739eb4-6b8b-4bc7-a1e6-790180668c93?source=cve
- https://github.com/advisories/GHSA-4969-3qm4-pr7h