CVE-2026-1857

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This is due to insufficient validation of the `endpoint` parameter in the `get_items()` function of the GetResponse REST API handler. The endpoint's permission check only requires `edit_posts` capability (Contributor role) rather than `manage_options` (Administrator). This makes it possible for authenticated attackers, with Contributor-level access and above, to make server-side requests to arbitrary endpoints on the configured GetResponse API server, retrieving sensitive data such as contacts, campaigns, and mailing lists using the site's stored API credentials. The stored API key is also leaked in the request headers.

• CWE-918

• https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/advanced-form/getresponse-rest-api.php#L57
• https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/advanced-form/getresponse-rest-api.php#L77
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3454881%40kadence-blocks%2Ftrunk&old=3453204%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea8d38a-f5ce-40dd-a015-f56d60579e05?source=cve

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18536Data::Entropy versions before 0.010 for Perl read remote ent…7.5
• CVE-2026-1854The Post Flagger plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-18556Authentication bypass using an alternate path or channel vul…7.4
• CVE-2026-1856The Appointment Booking Calendar plugin for WordPress is vul…6.4
• CVE-2026-18568XML::Sig versions from 0.29 before 0.72 for Perl allow signa…7.5
• CVE-2026-18569A flaw was found in the backchannel logout endpoint of the k…3.7
• CVE-2026-18570A flaw was found in the full-scope-disabled client-policy ex…5.4
• CVE-2026-18571A flaw was found in the user creation component of Keycloak …7.2
• CVE-2026-18572Keycloak provides authorization services that allow administ…6.5
• CVE-2026-18573A flaw was found in the keycloak-services component of Keycl…6.5
• CVE-2026-18574An authentication bypass vulnerability in Check Point Securi…9.3
• CVE-2026-18577An incomplete patch for CVE-2026-18556 allows for authentica…8.1