CVE-2026-16302

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.

• CWE-200

• https://plugins.trac.wordpress.org/changeset/3630074/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/eede8a1e-db33-4c07-9991-9def75dddc87?source=cve

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16296The Clearfy Cache WordPress plugin before 2.4.3 does not va…4.7
• CVE-2026-16297The Clearfy Cache WordPress plugin before 2.4.3 does not re…4.1
• CVE-2026-16298The FoodBoxBooker WordPress plugin before 1.0.7 does not pro…9.8
• CVE-2026-16299The Single Sign On For TNG WordPress plugin before 2.2.0 doe…9.8
• CVE-2026-1630WEBCON BPS is vulnerable to Reflected XSS via one of paramet…5.1
• CVE-2026-16300The ChamaWP WordPress plugin before 1.0.13 does not properl…9.8
• CVE-2026-16308IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, a…7.5
• CVE-2026-16309Authorization bypass through User-Controlled key vulnerabili…5.3
• CVE-2026-1631The Feeds for YouTube (YouTube video, channel, and gallery p…5.4
• CVE-2026-16310The MemberDash plugin for WordPress is vulnerable to Insecur…9.8
• CVE-2026-16312Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-16313A flaw was found in sg3_utils. The sg_inq command, when invo…7.6