CVE-2026-2633: Kadence WP Auth Bypass Vulnerability

CVE-2026-2633 Overview

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress contains a Missing Authorization vulnerability in all versions up to and including 3.6.1. This security flaw exists due to a missing capability check in the process_image_data_ajax_callback() function which handles the kadence_import_process_image_data AJAX action. The function's authorization check via verify_ajax_call() only validates edit_posts capability but fails to verify the upload_files capability, allowing authenticated attackers with Contributor-level access and above to upload arbitrary images from remote URLs to the WordPress Media Library.

Critical Impact

Authenticated attackers with Contributor-level access can bypass WordPress's standard capability restrictions to upload arbitrary images from remote URLs, potentially enabling stored XSS attacks, phishing content injection, or malicious file storage on compromised WordPress installations.

Affected Products

• Gutenberg Blocks with AI by Kadence WP plugin for WordPress versions up to and including 3.6.1
• WordPress installations using vulnerable Kadence Blocks plugin versions
• Sites with Contributor-level or higher user accounts

Discovery Timeline

• 2026-02-18 - CVE-2026-2633 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2633

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization) and affects the image import functionality within the Kadence Blocks plugin. The root issue lies in the incomplete authorization check implementation where the verify_ajax_call() function only validates that a user has edit_posts capability but neglects to verify the upload_files capability. In WordPress's permission model, Contributors are intentionally restricted from uploading files to prevent potential abuse, but this vulnerability circumvents that security boundary.

The vulnerable AJAX action kadence_import_process_image_data can be triggered by any authenticated user with Contributor-level privileges, allowing them to fetch and store images from arbitrary external URLs into the WordPress Media Library. This represents a privilege escalation where Contributors gain file upload capabilities they should not possess.

Root Cause

The vulnerability stems from an insufficient authorization check in the process_image_data_ajax_callback() function located in class-kadence-blocks-prebuilt-library.php. The function relies on verify_ajax_call() for authorization, which only checks for edit_posts capability. WordPress's security model requires the upload_files capability for media library uploads, but this check is absent from the vulnerable code path. This oversight allows users who can edit posts (Contributors and above) to perform file uploads they should be restricted from executing.

Attack Vector

An attacker with Contributor-level access to a WordPress site running a vulnerable version of Kadence Blocks can exploit this vulnerability through the following mechanism:

1. The attacker authenticates to WordPress with Contributor credentials
2. The attacker crafts an AJAX request to the kadence_import_process_image_data action
3. The request includes a remote URL pointing to an arbitrary image file
4. The process_image_data_ajax_callback() function processes the request
5. The authorization check only validates edit_posts capability, which Contributors possess
6. The image is fetched from the remote URL and stored in the WordPress Media Library
7. The attacker successfully uploads content bypassing WordPress's file upload restrictions

This attack vector is network-accessible and requires low privileges (Contributor account), making it relatively accessible to malicious insiders or compromised low-privilege accounts.

Detection Methods for CVE-2026-2633

Indicators of Compromise

• Unexpected images appearing in the WordPress Media Library uploaded by Contributor-level users
• AJAX requests to kadence_import_process_image_data action from users without upload_files capability
• Media library entries with external source URLs in metadata that were not created through legitimate workflows
• Unusual activity patterns from Contributor accounts including bulk image imports

Detection Strategies

• Monitor WordPress AJAX requests for kadence_import_process_image_data action calls from non-privileged users
• Implement logging for Media Library uploads and correlate with user capability levels
• Review web application firewall logs for unusual POST requests to admin-ajax.php containing image import parameters
• Audit user activity logs for Contributor accounts performing media-related operations

Monitoring Recommendations

• Enable WordPress activity logging plugins to track AJAX actions and media uploads
• Configure alerts for Media Library modifications by users without upload_files capability
• Implement file integrity monitoring on the WordPress uploads directory
• Review server access logs for patterns indicating automated exploitation attempts

How to Mitigate CVE-2026-2633

Immediate Actions Required

• Update the Kadence Blocks plugin to the latest patched version immediately
• Audit all Contributor and Author level accounts for suspicious activity or unauthorized media uploads
• Review the WordPress Media Library for any unexpected or suspicious image files
• Consider temporarily restricting Contributor access until the patch is applied

Patch Information

A security patch has been released by Kadence WP to address this vulnerability. The fix adds proper capability checking for upload_files in addition to the existing edit_posts check within the process_image_data_ajax_callback() function. Administrators should update to the latest version of the Kadence Blocks plugin through the WordPress plugin update mechanism. The WordPress Change Log contains details about the security fix.

Additional technical details about the vulnerability can be found in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Kadence Blocks plugin if immediate patching is not possible
• Restrict Contributor-level access to trusted users only until the patch is applied
• Implement a Web Application Firewall rule to block AJAX requests to kadence_import_process_image_data action
• Remove Contributor accounts that are not actively needed to reduce the attack surface

# WordPress CLI command to update the Kadence Blocks plugin
wp plugin update kadence-blocks

# Verify the installed version after update
wp plugin get kadence-blocks --field=version