Kadence WP Blocks Plugin Incorrect Authorization RCE/CVE-2026-15266

Vulnerability Overview Vulnerability Name: Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication CVE ID: CVE-2026-15266 CVSS Score: 4.3 (Medium) Publication Date: February 10, 2026 Last Updated Date: July 10, 2026 Researcher: johska Impact Scope Affected Versions: <= 3.5.32 Fixed Version: 3.6.0 or higher Remediation Remediation Measure: Update to version 3.6.0 or higher Vulnerability Description This vulnerability exists in the Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin. Due to improper permission checks in the function, unauthorized users (at the Contributor role or higher) can create and immediately publish any type of post (including pages), bypassing the standard WordPress moderation workflow. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Name: kadence-blocks Patch Status: Patched Affected Versions: <= 3.5.32 Fixed Version: 3.6.0 Recent Vulnerabilities List Other Information Copyright: 2012-2026 Defiant Inc. License: This vulnerability intelligence is permitted to be copied, distributed, and modified under the licensing terms of Defiant Inc. MITRE Corporation: This vulnerability intelligence is permitted to be copied, distributed, and modified under the licensing terms of MITRE Corporation. Contact Information Contact Email: info-support@wordfence.com Business Hours Working Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days/year, 1-hour response time Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Products & Services Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Subscription Form: Sign Up Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence: Wordfence Intelligence Summary This vulnerability affects the Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin in versions <= 3.5.32, with a fixed version available at 3.6.0 or higher. The vulnerability type is unauthorized access, with a CVSS score of 4.3 (Medium). It is recommended to update to the fixed version as soon as possible to eliminate the risk.

Goal Reached Thanks to every supporter — we hit 100%!

Kadence WP Blocks Plugin Incorrect Authorization RCE/CVE-2026-15266

More from this source