CVE-2026-7465
published 2026-05-30CVE-2026-7465: The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and…
PriorityP180high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.17%
63.6th percentile
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| brainstormforce | spectra_gutenberg_blocks_website_builder_for_the_block_editor | <= 2.19.25 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25.
ghsa_unreviewed·2026-05-30
CVE-2026-7465 [HIGH] CWE-269 The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25.
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.
VulDB
brainstormforce Spectra Gutenberg Blocks Plugin up to 2.19.25 on WordPress call_user_func render_callback privileges management
vuldb·2026-05-30·CVSS 8.8
CVE-2026-7465 [HIGH] brainstormforce Spectra Gutenberg Blocks Plugin up to 2.19.25 on WordPress call_user_func render_callback privileges management
A vulnerability identified as critical has been detected in brainstormforce Spectra Gutenberg Blocks Plugin up to 2.19.25 on WordPress. This vulnerability affects the function call_user_func. Performing a manipulation of the argument render_callback results in improper privilege management.
This vulnerability is known as CVE-2026-7465. Remote exploitation of the attack is possible. No exploit is available.
You should upgrade the affected component.
VulnCheck
brainstormforce spectra Improper Privilege Management
vulncheck·2026·CVSS 8.8
CVE-2026-7465 [HIGH] brainstormforce spectra Improper Privilege Management
brainstormforce spectra Improper Privilege Management
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.
Affected: brainstormforce spectra
Required Action: Apply remediations or mitigations per vendor instructions or
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.25/classes/class-uagb-init-blocks.php#L330https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.25/classes/class-uagb-init-blocks.php#L335https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/classes/class-uagb-init-blocks.php#L330https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/classes/class-uagb-init-blocks.php#L335https://wordpress.org/plugins/ultimate-addons-for-gutenberg/#developershttps://www.wordfence.com/threat-intel/vulnerabilities/id/60013752-d7cf-46e8-84e1-1b614f737b46?source=cve
2026-05-30
Published
Exploited in the wild