CVE-2026-15286
Received Received - Intake

Unauthorized Post Publication in Gutenberg Blocks with AI by Kadence WP

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured capability check on the 'get_items_permission_check' function permission callback of the 'process_pattern' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create and immediately publish posts of any type (including pages), bypassing the standard WordPress review workflow where contributors must submit posts for administrator approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-15286
EUVD
EUVD-2026-42795

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kadence_wp gutenberg_blocks_with_ai to 3.5.32 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Impact Analysis

This vulnerability can impact you by allowing users with Contributor-level access or above to bypass the standard content review process and publish posts immediately. This could lead to unauthorized or unreviewed content being published on your WordPress site.

Such unauthorized publication can result in content integrity issues, potential misinformation, or exposure of sensitive information if contributors publish content without proper oversight.

Executive Summary

The vulnerability exists in the Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress, in all versions up to and including 3.5.32. It is caused by a misconfigured capability check on the 'get_items_permission_check' function permission callback of the 'process_pattern' REST API endpoint.

This misconfiguration allows authenticated users with Contributor-level access or higher to create and immediately publish posts of any type, including pages, without going through the normal WordPress review workflow that requires administrator approval.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart