# CVE-2026-66696: Kadence Blocks sensitive data exposure in Gutenberg editor

Source: https://junglewise.ai/threats/cve-2026-66696-kadence-blocks-sensitive-data-exposure-in-gutenberg-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66696 · Severity: medium · CVSS 4.3 · Published 2026-08-06

Kadence Blocks is a popular WordPress plugin providing page building and content editing capabilities through the Gutenberg editor. A vulnerability in versions 3.7.8 and earlier allows contributors with basic editing privileges to access and expose sensitive data (such as passwords, email addresses, or payment details) that should be restricted from their role level. This could lead to unauthorized disclosure of confidential information.

## Quick answers

**Is CVE-2026-66696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66696 being exploited in the wild.

**How severe is CVE-2026-66696?** Medium severity, with a CVSS score of 4.3, published 6 August 2026.

**Which products and versions are affected?** Liquid Web / StellarWP Kadence Blocks 3.7.8 and earlier.

**Is there a fix for CVE-2026-66696?** A patch was published on 2026-08-06T15:17:22.73+00:00: Fixed in version 3.7.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66696 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66696?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as sensitive data exposure in the Kadence Blocks plugin for WordPress Gutenberg. A contributor-level user (a role with limited privileges intended for content submission only) can access and exfiltrate sensitive data that should be restricted by role-based access controls. The attack requires network access and valid plugin installation but no admin authentication—only basic contributor credentials are needed. The vulnerability was patched in version 3.7.8.1 and later. The root cause appears to stem from inadequate permission checks on sensitive data retrieval or display functions within the block editor interface.

## Affected products

- Liquid Web / StellarWP Kadence Blocks 3.7.8 and earlier

## Timeline

- 2026-07-29: disclosed
- 2026-08-06: patched: Fixed in version 3.7.8.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-7-8-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-7-8-sensitive-data-exposure-vulnerability?_s_id=cve)