Junglewise Threat Intelligence

CVE-2026-7465: Brainstorm Force Spectra Gutenberg Blocks Remote Code Execution

CVE-2026-7465 · Severity: high · CVSS 8.8 · Published 2026-05-30

Technologies: Brainstorm Force Spectra Gutenberg Blocks – Website Builder for the Block Editor. Vendors: Brainstorm Force.

Executive brief

Spectra, a popular WordPress plugin used to build websites with the Gutenberg editor, contains a security flaw that allows users with basic contributor access to run unauthorized code on the server. By creating a specially crafted post, an attacker can take full control of the website's hosting environment. This could lead to complete data theft, website defacement, or the installation of persistent malware.

Technical details

The Spectra Gutenberg Blocks plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions up to and including 2.19.25. The vulnerability exists due to the way the plugin handles block registration and rendering during sequential page requests. An authenticated attacker with Contributor-level access or higher can exploit this by embedding a two-block payload in post content. The first block registers a fake 'uagb/'-prefixed block type with an attacker-defined 'render_callback'. The second block of the same type then triggers the execution of that callback via the 'call_user_func()' function during the rendering process. This allows for arbitrary PHP code execution on the underlying server.

Affected products

  • Brainstorm Force Spectra Gutenberg Blocks – Website Builder for the Block Editor up to, and including, 2.19.25

Timeline

  • 2026-05-30: advisory: Vulnerability published by NVD/Wordfence

References