Junglewise Threat Intelligence

CVE-2026-9227: CSSIgniter GutenBee arbitrary file upload in gutenbee_file_and_ext_json

CVE-2026-9227 · Severity: high · CVSS 8.8 · Published 2026-05-28

Executive brief

The GutenBee plugin for WordPress, which provides custom blocks for the Gutenberg editor, contains a security flaw in how it handles file uploads. An attacker with author-level permissions or higher can bypass security checks to upload malicious files, such as scripts, to the web server. This could allow the attacker to take full control of the website, access sensitive data, or disrupt operations.

Technical details

The vulnerability exists in the gutenbee_file_and_ext_json function due to an insecure implementation of a file extension check. The plugin uses the PHP strpos() function to verify if a filename contains '.json' rather than ensuring the string ends with that extension. This allows an authenticated attacker with author-level privileges or higher to upload files with double extensions (e.g., 'shell.json.php'). Because the server may execute the final extension, this leads to arbitrary file upload and remote code execution (RCE). The issue has been addressed in later versions by removing the flawed JSON upload whitelisting logic.

Affected products

  • CSSIgniter GutenBee – Gutenberg Blocks Up to, and including, 2.20.1

Timeline

  • 2026-05-28: disclosed
  • 2026-05-28: advisory

References