CVE-2026-15286: Gutenberg Blocks with AI Kadence WP Unauthorized Post Publication Vulnerability

Technical summary

The 'process_pattern' REST API endpoint in the Gutenberg Blocks with AI by Kadence WP plugin implements a permission callback function ('get_items_permission_check') that fails to enforce appropriate capability restrictions. The misconfigured callback permits authenticated users with Contributor-level capabilities or above to execute actions that should be restricted to administrative users. This allows direct publication of posts and pages through the REST API, circumventing WordPress's standard editorial workflow where contributors must have their content reviewed and approved by administrators before publication.

Business impact

Organizations relying on this plugin lose content governance controls. Contributor-level employees or compromised accounts can publish unvetted content directly to the site, potentially introducing misinformation, brand damage, malicious links, or policy violations without oversight. The impact scales with site complexity—publishing platforms, multi-author news sites, and enterprises with strict content policies face higher risk. Smaller teams may not immediately detect unauthorized publications.

Affected systems

WordPress installations using the Gutenberg Blocks with AI by Kadence WP plugin in versions 3.5.32 and earlier. The vulnerability requires an authenticated attacker account with Contributor role or higher (Contributor, Author, Editor, or Administrator). Sites without the plugin are not affected.

Exploitability

Exploitation requires valid WordPress authentication and Contributor-level or higher privileges. The attack is trivial once credentials are obtained—a simple REST API request to the 'process_pattern' endpoint suffices. No user interaction or complex technical knowledge is required. The barrier to entry is low for insiders, contractors, or accounts compromised through credential theft. The CVSS score of 4.3 (MEDIUM) reflects the requirement for prior authentication, which prevents unauthenticated public exploitation but underscores risk in multi-user environments.

Remediation

Update the Gutenberg Blocks with AI by Kadence WP plugin to a version released after the vulnerability disclosure. Verify the patched version against the vendor's official advisory. As an interim measure, restrict Contributor-level permissions on sites where editorial review is mandatory, or disable the plugin if it is not actively used. Review REST API access controls in your WordPress configuration.

Patch guidance

Check Kadence WP's official plugin repository or the vendor's security advisory for the first patched version released after July 10, 2026. Update through the WordPress admin dashboard (Plugins > Updates) or directly from the vendor. Before updating, back up your database and test in a staging environment, particularly if the plugin is heavily integrated with your site's patterns and templates. After patching, audit recent posts and pages published through the REST API to identify any unauthorized content.

Detection guidance

Monitor WordPress REST API logs for requests to the 'process_pattern' endpoint originating from Contributor or Author accounts. Enable WordPress security logging via plugins (e.g., Wordfence, WP Activity Log) or your host's logging service. Review post publication audit trails for entries showing posts created or published by Contributor-level users when such activity would normally require admin approval. Check for unexpected pages or posts authored by known contributors during the vulnerability window. If you lack REST API logging, prioritize implementing it post-patch.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), the vulnerability directly undermines content governance on publishing-centric sites. The ease of exploitation—once an attacker has credentials—combined with the insider threat and credential-compromise vectors, makes this a high-priority patch for organizations managing sensitive content, compliance-regulated communications, or multi-author platforms. Editorial workflow bypass is a business-critical control failure.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a misconfigured permission check that affects integrity (allowing unauthorized publication) without requiring user interaction or special network conditions. Authentication is mandatory, preventing external exploitation. Severity is MEDIUM because impact is localized to content integrity rather than confidentiality or availability. However, the actual business risk may be higher depending on your site's role—news or regulatory communication sites should treat this as HIGH priority despite the MEDIUM CVSS.

Frequently asked questions