Junglewise Threat Intelligence

CVE-2026-11357: StellarWP Kadence Blocks sensitive information exposure in editor_assets_variables

CVE-2026-11357 · Severity: medium · CVSS 4.3 · Published 2026-06-18

Technologies: StellarWP Kadence Blocks. Vendors: StellarWP.

Executive brief

A vulnerability in the Kadence Blocks WordPress plugin allows users with low-level 'Contributor' access to view sensitive account information. This includes the site owner's license keys and API credentials for the Kadence service. An attacker could use this information to potentially hijack the license or access associated account services, though it does not directly grant control over the website itself.

Technical details

The Kadence Blocks plugin for WordPress (versions <= 3.7.5) suffers from a sensitive information exposure vulnerability (CWE-200) within the 'editor_assets_variables' component. The plugin improperly exposes the 'proData' object, containing the Kadence account license key, owner email, API key, and license domain, to the client-side environment. This data is accessible via the 'window.kadence_blocks_params.proData' JavaScript object in the browser console. An authenticated attacker with Contributor-level permissions or higher can retrieve these credentials without any server-side request manipulation, provided an administrator has previously activated a valid license. A patch is available in versions following 3.7.5.

Affected products

  • StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor up to, and including, 3.7.5

Timeline

  • 2026-06-18: disclosed
  • 2026-06-18: advisory

References