CVE-2026-11357: Kadence Blocks Credential Exposure Vulnerability

Technical summary

CVE-2026-11357 is a sensitive information exposure vulnerability in Kadence Blocks plugin versions up to 3.7.5. The vulnerability stems from embedding critical authentication material (license key, license owner email, api_key, api_email, and license domain) in the editor_assets_variables object, which populates the browser-accessible window.kadence_blocks_params.proData property. This client-side exposure means any user with contributor or higher permissions can inspect the credentials directly from the browser console without triggering server-side requests or WAF rules. The vulnerability is trivial to exploit once initial access to the WordPress editor is obtained.

Business impact

Organizations using Kadence Blocks risk unauthorized API access to their Kadence ecosystem via exposed API keys and license credentials. If an API key is compromised, attackers can interact with Kadence services, potentially modifying site blocks, accessing account settings, or pivoting to other connected infrastructure. The exposure is particularly risky for multi-site operations or agencies managing multiple client sites, where a single compromised contributor account grants access to credentials across platforms. Additionally, exposed license owner emails may be leveraged for account takeover attacks against the Kadence account itself.

Affected systems

All WordPress installations running Kadence Blocks plugin version 3.7.5 and earlier are vulnerable. The plugin must be active, and the site administrator must have previously connected a valid Kadence license for the vulnerability to manifest. Contributor-level users and above in WordPress can exploit the vulnerability; this includes contributors, authors, editors, and administrators. Any organization running this plugin with an active Kadence license should assess exposure immediately.

Exploitability

Exploitability is straightforward and requires minimal sophistication. An attacker needs only WordPress contributor-level access and basic knowledge of opening the browser console (F12 or Ctrl+Shift+I). No authentication bypass, race conditions, or complex interaction chains are needed. The credentials are present in plaintext memory as soon as the block editor loads. The CVSS score of 4.3 reflects the requirement for authenticated access (PR:L) but correctly captures the low complexity and direct confidentiality impact. The vulnerability is not currently listed in CISA's KEV catalog.

Remediation

Update the Kadence Blocks plugin to a version that removes sensitive credentials from client-side JavaScript variables. Verify the patched version number in the vendor's official advisory before upgrading. As an interim measure, restrict contributor access to users who absolutely require block editing capabilities, and monitor WordPress user accounts for unauthorized privilege elevation. Consider disabling the Kadence Blocks plugin entirely if the license connection is not actively in use.

Patch guidance

Check the Kadence Blocks plugin repository and Kadence's official security advisories for the patched version number. Apply the update immediately to all affected WordPress instances. After updating, verify that the window.kadence_blocks_params.proData object no longer contains sensitive credentials by inspecting the browser console on a test editor instance. Test block functionality post-patch to ensure no regression. If a patch is not yet available at your time of assessment, consider temporarily deactivating the plugin while awaiting a fix.

Detection guidance

On WordPress instances running Kadence Blocks, audit contributor-level and above user accounts to identify which accounts have accessed the block editor recently. Enable WordPress security logging to track editor access and privilege elevation events. Use browser-based endpoint detection to identify console access patterns that may indicate credential harvesting. If you have access to server logs, look for POST requests to Kadence API endpoints from unexpected IP addresses or user agents, which may indicate compromised API keys in use. API key rotation and revocation through the Kadence account dashboard can terminate any leaked credentials.

Why prioritize this

Although the CVSS score is medium (4.3), prioritize remediation based on your contributor access distribution. If contributors are few and tightly controlled, risk is lower; if many external users or contractors have contributor access, risk rises significantly. The exposure of API credentials justifies rapid patching regardless of score, as it enables persistent access to the Kadence ecosystem. The vulnerability requires no zero-day exploit code and can be weaponized immediately by insiders or anyone who obtains contributor access through a secondary compromise.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) appropriately reflects a network-accessible vulnerability with low attack complexity, low-privilege requirement, no user interaction, and confidentiality impact only. The score does not reflect organizational risk regarding API credential exposure, which may warrant higher internal prioritization. The absence of integrity or availability impact keeps the score moderate, but the nature of the exposed credentials (API keys, license keys) enables downstream attacks that could inflate actual business impact.

Frequently asked questions