CVE-2026-7465
Deferred Deferred - Pending Action
Remote Code Execution in Spectra Gutenberg Blocks WordPress Plugin

Publication date: 2026-05-30

Last updated on: 2026-06-01

Assigner: Wordfence

Description
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-30
Last Modified
2026-06-01
Generated
2026-06-19
AI Q&A
2026-05-30
EPSS Evaluated
2026-06-18
NVD
CVE-2026-7465
EUVD
EUVD-2026-33454
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
brainstormforce spectra_gutenberg_blocks to 2.19.25 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress has a Remote Code Execution vulnerability in all versions up to and including 2.19.25.

This vulnerability allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server.

Exploitation requires embedding a two-block payload in post content: the first block registers a fake block type with an attacker-defined render callback, and the second block triggers execution of that callback during block rendering in the same page request.

Impact Analysis

This vulnerability can have severe impacts because it allows attackers with relatively low privileges (Contributor-level) to execute arbitrary code on the server.

Such code execution can lead to full compromise of the affected WordPress site, including data theft, site defacement, installation of malware, or further attacks on connected systems.

The CVSS score of 8.8 indicates a high severity, with impacts on confidentiality, integrity, and availability.

Mitigation Strategies

To mitigate this vulnerability, immediately update the Spectra Gutenberg Blocks plugin to a version later than 2.19.25 where the issue is fixed.

Additionally, restrict Contributor-level and higher user permissions carefully, as exploitation requires authenticated users with at least Contributor access.

Consider monitoring and auditing post content for suspicious blocks that register fake uagb/-prefixed block types, which are used in the exploit.

Compliance Impact

The Spectra Gutenberg Blocks plugin supports GDPR compliance by enabling local Google Fonts loading and providing SEO-friendly blocks, which helps users meet privacy standards.

However, the vulnerability allowing authenticated attackers with Contributor-level access to execute remote code on the server poses a significant security risk. Such a risk could lead to unauthorized data access or manipulation, potentially impacting compliance with regulations like GDPR and HIPAA that require protection of personal and sensitive data.

Therefore, exploitation of this vulnerability could undermine the security controls necessary for compliance with these standards, increasing the risk of data breaches and regulatory violations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7465. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart