CVE-2026-0950: Spectra Gutenberg Blocks Info Disclosure

CVE-2026-0950 Overview

CVE-2026-0950 is an information disclosure vulnerability in the Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress. The flaw affects all plugin versions up to and including 2.19.17. The plugin fails to call post_password_required() before rendering post excerpts in the render_excerpt() function and the uagb_get_excerpt() helper. Unauthenticated attackers can read excerpts of password-protected posts by viewing any page containing a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block. The issue is tracked under [CWE-200] Information Exposure.

Critical Impact
Unauthenticated remote attackers can extract excerpt content from password-protected WordPress posts without supplying the post password, undermining the confidentiality control that password protection is intended to provide.

Affected Products

Spectra Gutenberg Blocks – Website Builder for the Block Editor (ultimate-addons-for-gutenberg) for WordPress
All plugin versions up to and including 2.19.17
WordPress sites using Post Grid, Post Masonry, Post Carousel, or Post Timeline Spectra blocks

Discovery Timeline

2026-02-03 - CVE-2026-0950 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0950

Vulnerability Analysis

The vulnerability resides in the post rendering logic of the Spectra plugin. When a page contains a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block, the plugin enumerates posts and renders excerpts for each item. The rendering functions do not verify whether the underlying post is password-protected before emitting excerpt content. As a result, excerpt text intended to remain hidden behind WordPress password protection is exposed to any visitor, including unauthenticated users.

The affected code paths are referenced in blocks-config/post/class-uagb-post.php (lines 1303, 1621, and 2196) and in classes/class-uagb-helper.php (line 1403). The fix appears in WordPress changeset 3443216.

Root Cause

The root cause is a missing access control check. The render_excerpt() function and the uagb_get_excerpt() helper omit a call to WordPress's post_password_required() API. WordPress core relies on this function to gate access to content belonging to password-protected posts. Without the check, the plugin treats password-protected posts identically to public posts when generating excerpt output.

Attack Vector

An attacker requires no authentication and no user interaction. The attacker visits any public page that embeds one of the four affected Spectra block types. If that block queries a post that is password-protected, the rendered HTML returned to the unauthenticated visitor contains the excerpt of the protected post. The vulnerability is exploited entirely over the network through ordinary HTTP requests, with no special tooling required.

For implementation details, see the Wordfence Vulnerability Report and the vulnerable code in class-uagb-post.php.

Detection Methods for CVE-2026-0950

Indicators of Compromise

Web server access logs showing unauthenticated GET requests to pages embedding Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline blocks where password-protected posts are queried.
HTML responses from those pages that contain excerpt text matching the bodies of posts marked as password-protected in the WordPress database.
Spectra plugin version reported as 2.19.17 or earlier in the wp_options or plugin directory metadata.

Detection Strategies

Inventory all WordPress sites and identify those running the Spectra (ultimate-addons-for-gutenberg) plugin at version 2.19.17 or below.
Crawl public-facing pages and compare rendered excerpt content against the list of password-protected posts in the database to confirm exposure.
Use a WordPress vulnerability scanner that ingests the Wordfence advisory feed to flag affected installations automatically.

Monitoring Recommendations

Monitor outbound HTTP responses from WordPress origins for excerpt text tied to post IDs that are flagged as password-protected.
Track plugin version changes in WordPress instances through file integrity monitoring on wp-content/plugins/ultimate-addons-for-gutenberg/.
Alert on anomalous scraping behavior against pages that host Spectra post listing blocks.

How to Mitigate CVE-2026-0950

Immediate Actions Required

Update the Spectra Gutenberg Blocks plugin to a version newer than 2.19.17 on every WordPress site in the environment.
Audit which posts are password-protected and review whether their excerpts contain sensitive information that may have already been disclosed.
Rotate or revise any sensitive content placed in excerpts of password-protected posts, since prior exposure cannot be undone.

Patch Information

The vendor addressed the issue in a release subsequent to 2.19.17, applied via WordPress changeset 3443216. The patch adds the missing post_password_required() check before excerpt rendering in both render_excerpt() and uagb_get_excerpt(). Refer to the Wordfence advisory for the fixed version identifier.

Workarounds

Temporarily remove Spectra Post Grid, Post Masonry, Post Carousel, and Post Timeline blocks from any page that may surface password-protected posts.
Exclude password-protected posts from the queries used by those blocks via the block settings or a custom pre_get_posts filter.
Restrict excerpt content on password-protected posts to non-sensitive placeholder text until the plugin is updated.

bash

# Identify vulnerable Spectra installations across managed WordPress sites
wp plugin get ultimate-addons-for-gutenberg --field=version
# Update to the patched release once the plugin is upgraded
wp plugin update ultimate-addons-for-gutenberg