Spectra Gutenberg Blocks CVE-2026-7465: Authenticated Remote Code Execution via Arbitrary PHP Function Call

漏洞概述 漏洞名称: Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes CVE ID: CVE-2026-7465 CVSS 评分: 8.8 (High) 发布日期: May 29, 2026 最后更新日期: May 30, 2026 研究者: ka63001 影响范围 软件类型: Plugin 软件名称: Spectra Gutenberg Blocks – Website Builder for the Block Editor 受影响版本: <= 2.19.25 修复版本: 2.19.26 修复方案 修复建议: 升级到版本 2.19.26 或更新的已修复版本。 其他信息 漏洞描述: Spectra Gutenberg Blocks – Website Builder for the Block Editor 插件在版本 2.19.25 及之前存在远程代码执行漏洞。攻击者可以通过构造特定的块属性，触发任意 PHP 函数调用，从而执行恶意代码。 参考链接: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - wordpress.org 近期相关漏洞 Spectra <= 2.19.22 - Missing Authorization - CVE ID: CVE-2026-42648 - CVSS 评分: 4.3 - 研究者: Trương Hữu Phúc (truonghuphuc) - 发布日期: March 27, 2026 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data - CVE ID: CVE-2026-0950 - CVSS 评分: 5.3 - 研究者: johka - 发布日期: February 2, 2026 Spectra <= 2.19.17 - Missing Authorization - CVE ID: CVE-2026-24982 - CVSS 评分: 5.3 - 研究者: Bao - BlueRock - 发布日期: January 17, 2026 Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS - CVE ID: CVE-2025-11162 - CVSS 评分: 6.4 - 研究者: Muhammad Yudha - DJ - 发布日期: November 4, 2025 Spectra - WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-1784 - CVSS 评分: 6.4 - 研究者: Peter Thaleikis - 发布日期: March 25, 2025 Spectra - WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget - CVE ID: CVE-2024-10484 - CVSS 评分: 6.4 - 研究者: zer0h0st - 发布日期: December 2, 2024 Spectra - WordPress Gutenberg Blocks <= 2.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-7590 - CVSS 评分: 6.4 - 研究者: João Pedro Soares de Alcântara - 发布日期: August 7, 2024 Spectra <= 2.13.7 - Missing Authorization via generate_ai_content - CVE ID: CVE-2024-37517 - CVSS 评分: 4.3 - 研究者: Rafie Muhammad - 发布日期: July 5, 2024 Spectra - WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting - CVE ID: CVE-2024-4366 - CVSS 评分: 6.4 - 研究者: Ngô Thiên An (ancom_) - 发布日期: May 23, 2024 Spectra - WordPress Gutenberg Blocks <= 2.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block - CVE ID: CVE-2024-1815 - CVSS 评分: 6.4 - 研究者: wesley (wcraft) - 发布日期: May 22, 2024 总结 该漏洞允许经过身份验证的用户（Contributor 及以上权限）通过构造特定的块属性，触发任意 PHP 函数调用，从而实现远程代码执行。建议用户尽快升级到版本 2.19.26 或更新的已修复版本以修复此漏洞。

目標達成すべての支援者に感謝 — 100%達成しました！

Spectra Gutenberg Blocks CVE-2026-7465: Authenticated Remote Code Execution via Arbitrary PHP Function Call

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Spectra Gutenberg Blocks CVE-2026-7465: Authenticated Remote Code Execution via Arbitrary PHP Function Call

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！