CVE-2026-92294
Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page'…
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Spectra Gutenberg Blocks plugin for WordPress, a block editor website builder, is affected by this flaw. An unauthenticated attacker could exploit it to delete or modify theme files on the affected server, which could break a site's appearance or functionality.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- brainstormforce Spectra Legacy – Gutenberg Blocks
through 2.20.4
References 6
plugins.trac.wordpress.org
- browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L101
- browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L93
- browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L584
- browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-loader.php#L302
- changeset/3736176