CVE-2026-12902: Kadence Blocks Auth Bypass Vulnerability

CVE-2026-12902 Overview

CVE-2026-12902 is an authorization bypass vulnerability in the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress. The flaw affects all versions up to and including 3.7.7. The plugin fails to verify that a user is authorized to perform specific actions in its prebuilt library handlers. Authenticated attackers with contributor-level access or above can create arbitrary Media Library attachments. Exploitation downloads remote images into the site's uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassing the upload_files capability boundary. The issue is classified under CWE-862: Missing Authorization.

Critical Impact
Contributor-level users can populate the Media Library with attacker-controlled remote content, bypassing the upload_files capability required by WordPress core.

Affected Products

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress
All versions up to and including 3.7.7
WordPress sites permitting contributor-level registration or user roles

Discovery Timeline

2026-07-01 - CVE-2026-12902 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12902

Vulnerability Analysis

The vulnerability resides in the class-kadence-blocks-prebuilt-library.php file, which exposes handlers used by the plugin's prebuilt template library. These handlers accept remote image URLs and pass them to WordPress attachment functions without verifying that the current user holds the upload_files capability. Contributor-level accounts, which WordPress core denies media upload rights by default, can therefore write files to the uploads directory and register them as Media Library attachments.

The result is a silent expansion of privilege for low-trust users. Attackers gain the ability to introduce attacker-hosted content into the site, use the site as a redistribution point for arbitrary image files, or pollute the Media Library with unwanted objects.

Root Cause

The root cause is a missing authorization check [CWE-862] in the AJAX handlers responsible for importing prebuilt templates and their remote assets. The handlers verify authentication but do not enforce the upload_files capability before calling wp_upload_bits() and wp_insert_attachment(). WordPress core relies on that capability as the boundary between contributors and authors; the plugin's direct calls to the underlying attachment APIs circumvent that boundary.

Attack Vector

The attack requires an authenticated session with at least contributor-level access. The attacker sends a crafted request to the vulnerable plugin endpoint, supplying a remote image URL. The plugin fetches the remote resource and stores it as an attachment attributed to the site. No user interaction is required from an administrator, and the exploit path is network-accessible against any site that exposes contributor registration or has existing contributor accounts.

See the Wordfence Vulnerability Assessment and the Kadence Blocks source references for the specific handler locations.

Detection Methods for CVE-2026-12902

Indicators of Compromise

New Media Library attachments authored by contributor-level accounts that would normally lack the upload_files capability.
Files present in wp-content/uploads/ whose source URL or original hostname points to an external domain not associated with the site.
WordPress wp_posts entries with post_type = 'attachment' and post_author values mapped to contributor roles.

Detection Strategies

Review WordPress access logs for POST requests to the admin-ajax.php endpoint invoking Kadence Blocks prebuilt library actions from contributor sessions.
Compare Media Library entries against user role assignments and flag attachments created by roles below author.
Monitor outbound HTTP requests from the web server to unfamiliar image hosts, since exploitation triggers a server-side fetch of the attacker-supplied URL.

Monitoring Recommendations

Enable WordPress audit logging for attachment creation events and correlate post_author role at insertion time.
Alert on file writes to wp-content/uploads/ that originate from PHP processes handling AJAX requests tied to the Kadence Blocks plugin.
Track the installed version of Kadence Blocks across your WordPress fleet and alert when any instance reports a version at or below 3.7.7.

How to Mitigate CVE-2026-12902

Immediate Actions Required

Update Kadence Blocks to a version later than 3.7.7 that contains the authorization check fix referenced in the Kadence Blocks changeset.
Audit all existing contributor and higher accounts, remove unused accounts, and reset credentials where suspicious activity is observed.
Review the Media Library for attachments created by contributor accounts and remove any that are not attributable to legitimate editorial workflows.

Patch Information

The vendor addressed the vulnerability by adding capability verification to the affected handlers in class-kadence-blocks-prebuilt-library.php. Site owners should install the patched release through the WordPress plugin updater. Details are available in the Kadence Blocks Change Log.

Workarounds

Restrict new user registration and disable self-service contributor sign-up until the plugin is updated.
Temporarily deactivate the Kadence Blocks plugin on sites where an immediate update is not feasible.
Use a web application firewall rule to block AJAX requests targeting the vulnerable Kadence Blocks prebuilt library actions from non-administrative sessions.

bash

# Configuration example: verify installed plugin version and update via WP-CLI
wp plugin get kadence-blocks --field=version
wp plugin update kadence-blocks
wp plugin list --name=kadence-blocks --status=active