CVE-2026-92294
Received Received - Intake

Limited File Deletion in Spectra Gutenberg Blocks WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-92294
EUVD
EUVD-2026-114577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
brainstormforce Spectra Legacy – Gutenberg Blocks 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Spectra Gutenberg Blocks WordPress plugin. It allows unauthenticated attackers to delete theme files on the server due to insufficient file path validation in the plugin's code.

Detection Guidance

Check WordPress installations for the Spectra Gutenberg Blocks plugin versions up to 2.20.4. Look for unauthorized file deletions in theme directories. Review server logs for suspicious activity targeting the __construct function in the plugin.

Impact Analysis

An attacker could delete important theme files on your WordPress site, potentially breaking your website's appearance or functionality. This could lead to downtime or require restoration from backups.

Compliance Impact

This vulnerability allows unauthenticated attackers to delete theme files on the server, which could lead to unauthorized data exposure or system compromise. Such breaches may violate GDPR or HIPAA requirements for data integrity and security, depending on the affected system's use case.

Mitigation Strategies

Update the Spectra Gutenberg Blocks plugin to the latest version immediately. Remove the plugin if not essential. Restrict file deletion permissions on the server. Monitor for any signs of compromise or unauthorized file changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart