CVE-2026-7465

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request.

• CWE-269

• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.25/classes/class-uagb-init-blocks.php#L330
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.25/classes/class-uagb-init-blocks.php#L335
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/classes/class-uagb-init-blocks.php#L330
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/classes/class-uagb-init-blocks.php#L335
• https://wordpress.org/plugins/ultimate-addons-for-gutenberg/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/60013752-d7cf-46e8-84e1-1b614f737b46?source=cve

Published

May 30, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7458The User Verification by PickPlugins plugin for WordPress is…9.8
• CVE-2026-7459The Simple History – Track, Log, and Audit WordPress Changes…7.5
• CVE-2026-7460mailcow-dockerized contains a stored cross-site scripting vu…7.4
• CVE-2026-7461Improper neutralization of inputs used in an OS command in t…7.5
• CVE-2026-7462The VatanSMS WP SMS plugin for WordPress is vulnerable to Re…6.1
• CVE-2026-7464The WP Google Maps Integration plugin for WordPress is vulne…6.1
• CVE-2026-7466AgentFlow contains an arbitrary code execution vulnerability…8.8
• CVE-2026-7467The Read More & Accordion plugin for WordPress is vulnerable…8.8
• CVE-2026-7468A security vulnerability has been detected in 1024-lab smart…7.3
• CVE-2026-7469A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V…6.3
• CVE-2026-7470A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42…8.8
• CVE-2026-7471GitLab has remediated an issue in GitLab EE affecting all ve…3.5