Kadence Blocks, a popular WordPress page builder plugin with over 600,000 installations, had a missing authorization vulnerability in versions up to 3.6.3. The vulnerability allows authenticated users with the Contributor role to upload arbitrary files to the Media Library — a capability they shouldn’t have.
What’s the vulnerability?
The plugin’s REST API endpoint /kadence-blocks/v1/process_pattern processes image URLs from block content and downloads them to the Media Library. The endpoint checks whether the user can edit posts, but it doesn’t check whether they can upload files.
In WordPress, these are separate capabilities: – Contributor can edit their own posts but cannot upload media – Author can do both
By sending a crafted request to the endpoint with a URL pointing to any file, a Contributor can bypass the upload restriction and add arbitrary files to the Media Library. The plugin downloads the file and creates an attachment post without verifying the upload_files capability.
Why is this a problem?
An attacker with a Contributor account can: – Upload large files to exhaust server storage – Upload malicious files disguised as images – Consume your Media Library quota – Potentially host malware from your domain
For sites that grant Contributor access to freelancers, guest authors, or community members, this is a real privilege escalation.
How to check if you’re affected
Check your Kadence Blocks version: – Go to Plugins in WordPress admin – Find Kadence Blocks – If the version is 3.6.3 or earlier, you’re affected
If you’re running an older version and have Contributor-level users, assume the vulnerability has been exploited. Check your Media Library for suspicious uploads.
What to do
Update immediately to Kadence Blocks 3.6.4 or later. The patch adds a proper capability check to the endpoint.
If you can’t update right away: 1. Restrict Contributor access to Kadence Blocks (use a capability plugin or role manager) 2. Review your Media Library for unexpected files 3. Check your server disk usage for signs of abuse
After updating, audit your Media Library and remove any files uploaded by Contributor accounts that you don’t recognise.
The fix
The patched version checks for the upload_files capability before processing images:
if ( ! current_user_can( 'upload_files' ) ) {
return new WP_Error(
'rest_forbidden',
__( 'You do not have permission to upload files.' )
);
}Simple, but essential.
Vulnerability details: CVE-2026-2826, CVSS 4.3 (Medium)
Affected versions: Kadence Blocks up to 3.6.3
Patched: v3.6.4 (released 4 April 2026)
Researcher: Lukasz Sobanski (Wordfence)
If you’re managing multiple WordPress sites, automated vulnerability monitoring tools like Vulnz can alert you when patches like this are released, so you’re not caught off guard.