CVE-2026-15286: Kadence WP Auth Bypass Vulnerability

CVE-2026-15286 Overview

CVE-2026-15286 affects the Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress. All versions up to and including 3.5.32 contain a misconfigured capability check in the get_items_permission_check function serving as the permission callback for the process_pattern REST API endpoint. Authenticated attackers with Contributor-level access or higher can create and immediately publish posts of any type, including pages. The flaw bypasses the standard WordPress editorial workflow that requires contributors to submit posts for administrator review. The vulnerability is classified under CWE-863: Incorrect Authorization.

Critical Impact
Contributor-level accounts can bypass editorial review and publish arbitrary posts and pages directly to production WordPress sites running the Kadence Blocks plugin.

Affected Products

Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress
All plugin versions up to and including 3.5.32
WordPress sites where contributor-or-higher accounts are provisioned

Discovery Timeline

2026-07-10 - CVE-2026-15286 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15286

Vulnerability Analysis

The Kadence Blocks plugin exposes a REST API endpoint named process_pattern used by its prebuilt library feature. The endpoint is registered by the class-kadence-blocks-prebuilt-library-rest-api.php class and gates access using the get_items_permission_check callback. That permission callback validates whether the current user is authenticated but does not verify the capability required to publish content of arbitrary post types.

A contributor authenticated to WordPress can call this endpoint to create posts and pages that transition directly to a publish status. WordPress normally enforces the publish_posts capability separately from edit_posts, requiring contributors to save drafts and request editorial approval. The plugin's endpoint short-circuits that workflow because the underlying pattern-processing logic does not honor the caller's post-type capabilities before persisting content.

Root Cause

The root cause is an authorization gap. The permission callback grants access based on a broad authenticated-user check rather than verifying that the caller holds publish_posts or publish_pages for the requested post type. This aligns with CWE-863: Incorrect Authorization, where the application performs an authorization check but uses an incorrect predicate.

Attack Vector

Exploitation requires a valid WordPress account with Contributor privileges or higher. The attacker sends a crafted request to the process_pattern REST endpoint specifying the target post type and content. The endpoint accepts the request and publishes the resulting object without routing it through the pending-review queue. Attackers can use this primitive to inject SEO spam, phishing pages, or watering-hole content on trusted domains.

Technical references are available in the Kadence Blocks source at line 590, line 925, the remediating changeset #3445125, and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-15286

Indicators of Compromise

Unexpected published posts or pages authored by Contributor-role users in the WordPress wp_posts table with post_status = 'publish'.
HTTP POST requests to /wp-json/kb-design-library/v1/process_pattern originating from low-privilege session cookies.
Newly created pages containing pattern imports from unfamiliar external URLs or unexpected outbound links.

Detection Strategies

Audit WordPress access logs for process_pattern REST endpoint calls correlated with non-editor user IDs.
Compare the current plugin version against 3.5.32 across all managed WordPress installations and flag any at or below that baseline.
Review the post_author and post_status columns for contributor-owned rows that transitioned directly to publish without a preceding pending state in the revisions history.

Monitoring Recommendations

Alert on any REST API request to Kadence Blocks endpoints from accounts lacking the publish_posts capability.
Monitor WordPress user_meta and role changes to detect attackers escalating from subscriber to contributor prior to exploitation.
Track publication rate anomalies from contributor accounts using a web application firewall or SIEM correlation rule.

How to Mitigate CVE-2026-15286

Immediate Actions Required

Update the Kadence Blocks plugin to the version released in changeset #3445125 or later, which corrects the permission callback.
Audit all posts and pages published since the plugin was installed and remove unauthorized content authored by contributor accounts.
Review the WordPress user list and downgrade or remove contributor accounts that are not actively required.

Patch Information

The vendor fixed the vulnerability in the version following 3.5.32. The corrective code is committed in WordPress plugin repository changeset #3445125, which strengthens the capability check on the process_pattern endpoint. Site administrators should apply the update through the WordPress plugin dashboard or via wp-cli.

Workarounds

Restrict access to the /wp-json/kb-design-library/ REST namespace at the web application firewall so only editor-and-above roles can reach it until the patch is deployed.
Temporarily deactivate the Kadence Blocks plugin on sites that provision contributor accounts to untrusted authors.
Enforce two-factor authentication on all contributor-and-above accounts to reduce the risk of credential-based exploitation.

bash

# Update Kadence Blocks via wp-cli and verify installed version
wp plugin update kadence-blocks
wp plugin get kadence-blocks --field=version

# Identify posts published directly by contributor-role users
wp db query "SELECT ID, post_title, post_author, post_status, post_date \
  FROM wp_posts \
  WHERE post_status='publish' \
  AND post_author IN ( \
    SELECT user_id FROM wp_usermeta \
    WHERE meta_key='wp_capabilities' AND meta_value LIKE '%contributor%' \
  );"