CVE Database /
CVE-2026-12902
CVE · Medium
CVE-2026-12902 — Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.7.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-12902
|
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks] < 3.7.8 |
Missing Authorization |
Medium
4.3
|
< 3.7.8
|
3.7.8 |
2026-06-30 |
—
|
CVE-2026-12902
The Kadence Blocks plugin for WordPress contains a security flaw that allows unauthorized users to upload files to a website's server. Specifically, contributors and higher-level users can exploit this vulnerability by downloading images from external sources and saving them directly to the site's uploads directory without proper permission checks. This issue affects all versions of the plugin up to 3.7.7.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings