CVE-2026-92294 in Spectra Legacy Plugin
Summary
by MITRE • 10/31/2026
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified within the Spectra Gutenberg Blocks plugin, specifically affecting versions up through 2.20.4, represents a critical security flaw rooted in insufficient input validation during file system operations. The core technical issue resides in the constructor function of the plugin's codebase, where user-supplied data is processed without adequate sanitization or path traversal checks before being utilized in file deletion routines. This architectural weakness allows an attacker to manipulate the intended target paths by injecting directory traversal sequences such as dot-dot-slash characters into input parameters that are subsequently passed to system-level delete commands. Because this specific function does not strictly validate whether the provided file path remains within the expected application directories, it permits access to arbitrary locations on the server's filesystem where the web server has write permissions.
From an operational perspective, this vulnerability enables unauthenticated attackers to execute destructive actions against the underlying WordPress installation without requiring any form of user authentication or privilege escalation. The primary impact involves the deletion of theme files, which are essential for rendering the visual structure and styling of a website. By removing these critical assets, an attacker can effectively deface the site, cause service disruption by breaking layout integrity, or potentially pave the way for further attacks such as remote code execution if combined with other vulnerabilities like file upload flaws that allow placing malicious scripts in remaining directories. The ability to delete arbitrary files also poses a risk of data loss and increased recovery costs due to the need for restoring backups from scratch rather than simply patching a logical error.
This flaw aligns closely with Common Weakness Enumeration category CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, as well as CWE-732, concerning Incorrect Permission Assignment for Critical Resource. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Impact actions, specifically Data Destruction and Service Disruption, allowing adversaries to degrade the availability and integrity of web applications. The lack of authentication requirement places it in a high-risk category where automated scanning tools can easily discover and exploit the flaw across large segments of the internet running vulnerable WordPress instances.
To mitigate this risk, immediate action is required by upgrading the Spectra Gutenberg Blocks plugin to version 2.20.5 or later, which includes patches for path validation logic. Administrators should also implement strict file permission settings on their web servers to ensure that the web process user does not have write access to theme directories unless absolutely necessary for specific operational needs. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by filtering out requests containing directory traversal patterns before they reach the application logic. Regular auditing of plugin code and adherence to secure coding practices that enforce strict allow-listing of permitted file paths are essential long-term strategies to prevent similar vulnerabilities from being introduced in future updates or other plugins within the WordPress ecosystem.