CVE-2026-2633

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files.

• CWE-862

• https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L1177
• https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.32/includes/class-kadence-blocks-prebuilt-library.php#L789
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3454881%40kadence-blocks%2Ftrunk&old=3453204%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9c06e0a9-a13a-4cee-a1a5-c43c114b2dbf?source=cve

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26324OpenClaw is a personal AI assistant. Prior to version 2026.2…7.5
• CVE-2026-26325OpenClaw is a personal AI assistant. Prior to version 2026.2…7.2
• CVE-2026-26326OpenClaw is a personal AI assistant. Prior to version 2026.2…4.3
• CVE-2026-26327OpenClaw is a personal AI assistant. Discovery beacons (Bonj…6.5
• CVE-2026-26328OpenClaw is a personal AI assistant. Prior to version 2026.2…6.5
• CVE-2026-26329OpenClaw is a personal AI assistant. Prior to version 2026.2…6.5
• CVE-2026-26330Envoy is a high-performance edge/middle/service proxy. Prior…7.5
• CVE-2026-26331yt-dlp is a command-line audio/video downloader. Starting in…8.8
• CVE-2026-26332vm2 is an open source vm/sandbox for Node.js. Prior to versi…10
• CVE-2026-26333Calero VeraSMART versions prior to 2022 R1 expose an unauthe…9.8
• CVE-2026-26334Calero VeraSMART versions prior to 2026 R1 contain hardcoded…7.8
• CVE-2026-26335Calero VeraSMART versions prior to 2022 R1 use static ASP.NE…9.8