CVE-2026-1857: Kadence WP Gutenberg Blocks SSRF Vulnerability

CVE-2026-1857 Overview

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 3.6.1. This security flaw exists due to insufficient validation of the endpoint parameter in the get_items() function of the GetResponse REST API handler. The vulnerability allows authenticated attackers with Contributor-level access or higher to make server-side requests to arbitrary endpoints on the configured GetResponse API server.

Critical Impact

Authenticated attackers can exploit this vulnerability to retrieve sensitive data including contacts, campaigns, and mailing lists using the site's stored API credentials. Additionally, the stored API key is leaked in request headers, potentially enabling further unauthorized access to GetResponse accounts.

Affected Products

• Gutenberg Blocks with AI by Kadence WP plugin for WordPress versions ≤ 3.6.1
• WordPress sites using Kadence Blocks with GetResponse integration enabled

Discovery Timeline

• February 18, 2026 - CVE-2026-1857 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1857

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability stems from an improper access control decision combined with insufficient input validation. The GetResponse REST API handler's get_items() function accepts an endpoint parameter that is not adequately validated before being used to construct server-side requests. The core issue lies in the permission check implementation—the endpoint requires only edit_posts capability (available to Contributor role users) rather than the more restrictive manage_options capability (limited to Administrators).

This design flaw creates a significant attack surface, as WordPress sites commonly grant Contributor access to content creators, guest authors, and other non-administrative users. An attacker with these limited privileges can leverage the vulnerability to access the GetResponse API using credentials stored by site administrators, effectively bypassing the intended access controls.

Root Cause

The vulnerability originates from two security weaknesses in the getresponse-rest-api.php file:

1. Insufficient Authorization: The permission callback uses edit_posts capability instead of manage_options, allowing Contributor-level users to access functionality intended only for administrators.

2. Inadequate Input Validation: The endpoint parameter is passed to the API request handler without proper sanitization or allowlisting, enabling attackers to specify arbitrary API endpoints.

The combination of these flaws allows low-privileged users to craft requests that retrieve sensitive marketing data from the GetResponse platform, including contact information, campaign details, and mailing list configurations.

Attack Vector

The attack is network-based and requires the attacker to have an authenticated session with at least Contributor-level privileges on the target WordPress site. The exploitation process involves:

1. Authenticating to the WordPress site with Contributor or higher privileges
2. Crafting a REST API request to the vulnerable GetResponse handler endpoint
3. Specifying an arbitrary endpoint parameter value to access different GetResponse API resources
4. Extracting sensitive data from the API response, including contacts, campaigns, and mailing lists
5. Harvesting the API key leaked in request headers for potential further abuse

The vulnerability can be exploited through WordPress REST API calls targeting the GetResponse integration endpoint. Attackers can manipulate the endpoint parameter to access various GetResponse API resources beyond what their WordPress role should permit. For technical implementation details, see the WordPress Kadence Blocks Code Line 57 and WordPress Kadence Blocks Code Line 77 for vulnerable code references.

Detection Methods for CVE-2026-1857

Indicators of Compromise

• Unusual REST API requests to Kadence Blocks GetResponse endpoints from Contributor-level accounts
• Unexpected access patterns to the /wp-json/ endpoints related to GetResponse integration
• Multiple requests with varying endpoint parameter values from the same user session
• GetResponse API activity logs showing data access not initiated by administrators

Detection Strategies

• Monitor WordPress REST API access logs for requests to GetResponse-related endpoints from non-administrator users
• Implement alerting for unusual patterns in REST API requests targeting the Kadence Blocks integration
• Review WordPress user audit logs for Contributor accounts making API integration requests
• Analyze network traffic for outbound connections to GetResponse API with unexpected endpoint patterns

Monitoring Recommendations

• Enable detailed logging for WordPress REST API endpoints, particularly those associated with third-party integrations
• Configure alerts for any access to GetResponse REST API handlers by users without Administrator privileges
• Monitor GetResponse account activity logs for unauthorized data access correlating with WordPress site activity
• Implement Web Application Firewall (WAF) rules to detect and block SSRF attack patterns targeting the vulnerable endpoint

How to Mitigate CVE-2026-1857

Immediate Actions Required

• Update Kadence Blocks plugin to a version newer than 3.6.1 that includes the security fix
• Review user accounts with Contributor or higher roles and revoke unnecessary access
• Rotate GetResponse API keys if there is suspicion of compromise
• Audit GetResponse account access logs for unauthorized data retrieval

Patch Information

The Kadence WP development team has addressed this vulnerability in versions following 3.6.1. The fix involves implementing proper authorization checks requiring manage_options capability and adding validation for the endpoint parameter. Site administrators should update to the latest version of the Kadence Blocks plugin immediately.

For patch details, see the WordPress Kadence Blocks Changeset.

Workarounds

• Temporarily disable the GetResponse integration in Kadence Blocks until the patch can be applied
• Restrict Contributor role privileges using a WordPress security plugin to limit REST API access
• Remove stored GetResponse API credentials from WordPress until the plugin is updated
• Implement network-level controls to restrict outbound connections from the WordPress server to known-good destinations only

# Configuration example - Temporarily disable GetResponse REST API access via .htaccess
# Add to WordPress root .htaccess file to block access to vulnerable endpoint
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/kadence.*getresponse [NC]
    RewriteRule ^ - [F,L]
</IfModule>