stellarwp Kadence Blocks Plugin up to 3.7.7 on WordPress Attachments wp_upload_bits authorization

Summaryinfo

A vulnerability was found in stellarwp Kadence Blocks Plugin up to 3.7.7 on WordPress. It has been declared as critical. This impacts the function wp_upload_bits of the component Attachments Handler. Executing a manipulation can lead to authorization. This vulnerability is registered as CVE-2026-12902. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in stellarwp Kadence Blocks Plugin up to 3.7.7 on WordPress. It has been declared as critical. This vulnerability affects the function wp_upload_bits of the component Attachments Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create arbitrary Media Library attachments by downloading remote images to the site's uploads directory via wp_upload_bits() and wp_insert_attachment(), bypassing the upload_files capability boundary.

The weakness was published by se1en. The advisory is available at wordfence.com. This vulnerability was named CVE-2026-12902 since 06/22/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/01/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40895). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• stellarwp

Name

• Kadence Blocks Plugin

Version

• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion