CVE-2026-7465
Remote Code Execution in Spectra Gutenberg Blocks WordPress Plugin
Publication date: 2026-05-30
Last updated on: 2026-05-30
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| brainstormforce | spectra_gutenberg_blocks | to 2.19.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress has a Remote Code Execution vulnerability in all versions up to and including 2.19.25.
This vulnerability allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server.
Exploitation requires embedding a two-block payload in post content: the first block registers a fake block type with an attacker-defined render callback, and the second block triggers execution of that callback during block rendering in the same page request.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows attackers with relatively low privileges (Contributor-level) to execute arbitrary code on the server.
Such code execution can lead to full compromise of the affected WordPress site, including data theft, site defacement, installation of malware, or further attacks on connected systems.
The CVSS score of 8.8 indicates a high severity, with impacts on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Spectra Gutenberg Blocks plugin to a version later than 2.19.25 where the issue is fixed.
Additionally, restrict Contributor-level and higher user permissions carefully, as exploitation requires authenticated users with at least Contributor access.
Consider monitoring and auditing post content for suspicious blocks that register fake uagb/-prefixed block types, which are used in the exploit.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The Spectra Gutenberg Blocks plugin supports GDPR compliance by enabling local Google Fonts loading and providing SEO-friendly blocks, which helps users meet privacy standards.
However, the vulnerability allowing authenticated attackers with Contributor-level access to execute remote code on the server poses a significant security risk. Such a risk could lead to unauthorized data access or manipulation, potentially impacting compliance with regulations like GDPR and HIPAA that require protection of personal and sensitive data.
Therefore, exploitation of this vulnerability could undermine the security controls necessary for compliance with these standards, increasing the risk of data breaches and regulatory violations.