Junglewise Threat Intelligence

CVE-2026-12902: StellarWP Kadence Blocks authorization bypass in prebuilt library

CVE-2026-12902 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Executive brief

Kadence Blocks, a popular WordPress plugin used for designing website layouts, contains a security flaw that allows certain users to bypass standard upload restrictions. Users with basic contributor-level access can force the website to download and store images from external sources into the site's media library. While this does not allow for full site takeover, it could be used to clutter server storage or host unauthorized content on the organization's domain.

Technical details

The Kadence Blocks plugin for WordPress (versions up to 3.7.7) suffers from a missing authorization check (CWE-862) within its prebuilt library functionality. Specifically, the plugin fails to verify the 'upload_files' capability before executing media attachment functions. An authenticated attacker with at least contributor-level privileges can trigger 'wp_upload_bits()' and 'wp_insert_attachment()' to download arbitrary remote images into the WordPress uploads directory. This allows for the creation of unauthorized Media Library entries. The issue is addressed in versions following 3.7.7.

Affected products

  • StellarWP Kadence Blocks — Page Builder Toolkit for Gutenberg Editor up to, including 3.7.7

Timeline

  • 2026-07-01: advisory: NVD publication date

References

Related threats