CVE-2026-2608: 
WordPress vulnerability analysis and mitigation

CVE-2026-2608 is a Missing Authorization (Broken Access Control) vulnerability in the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor WordPress plugin. It affects all versions up to and including 3.5.32, allowing authenticated attackers with Contributor-level access or above to perform unauthorized actions such as publishing posts without proper authorization. The vulnerability was published on February 17, 2026, and patched in version 3.6.0. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The root cause is a missing capability check (CWE-862: Missing Authorization) on a function within the Kadence Blocks plugin, classified under OWASP Top 10 A1: Broken Access Control. An authenticated attacker with at minimum Contributor-level WordPress privileges can invoke this function over the network without additional complexity or user interaction, bypassing intended access controls. The specific function affected relates to post publication actions, enabling contributors to publish content they would not normally be authorized to publish (Patchstack, Feedly).

Successful exploitation allows authenticated contributors to perform unauthorized post publication actions on affected WordPress sites, resulting in a low integrity impact with no confidentiality or availability impact. While the scope is limited to the affected system, this could enable malicious contributors to publish unauthorized or harmful content on a WordPress site without editorial approval. The vulnerability is considered low severity and is unlikely to be exploited in targeted attacks, though it may appear in mass-exploit campaigns against WordPress installations (Patchstack).

The EPSS score for CVE-2026-2608 is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation, no known public proof-of-concept exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, limiting the attacker pool. Patchstack notes that vulnerabilities of this class can appear in mass-exploit campaigns targeting WordPress sites at scale (Feedly, Patchstack).

1. Reconnaissance: Identify WordPress sites running the Kadence Blocks plugin version 3.5.32 or earlier using tools like WPScan or Shodan queries targeting WordPress installations.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) WordPress account on the target site, as the vulnerability requires authentication.
3. Identify the Vulnerable Function: Locate the specific plugin function lacking a capability check, which handles post publication actions within the Kadence Blocks plugin.
4. Craft Unauthorized Request: Send a crafted HTTP request (e.g., via the WordPress REST API or admin-ajax.php) invoking the vulnerable function to trigger a post publication action that the contributor account would not normally be permitted to perform.
5. Achieve Unauthorized Action: The missing capability check allows the request to succeed, resulting in unauthorized content publication on the target WordPress site (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to admin-ajax.php or REST API endpoints associated with Kadence Blocks functions from Contributor-level user accounts; audit log entries showing post publication events attributed to users without editor or administrator roles.
• Content: Unexpected or unauthorized posts appearing in published state that were submitted by Contributor-level accounts without editorial review or approval.
• User Activity: Unusual activity from Contributor accounts performing actions typically restricted to Editor or Administrator roles within the WordPress dashboard.

The vendor (Liquid Web / StellarWP) has released a patched version: Kadence Blocks 3.6.0. Site administrators should update the plugin to version 3.6.0 or later immediately. If an immediate update is not possible, consider restricting Contributor-level account registrations or using a WordPress security plugin such as Patchstack (which offers virtual patching) to mitigate the risk until the update can be applied (Patchstack).

The vulnerability was reported through Patchstack's Active VDP (Vulnerability Disclosure Program) and credited to researcher 'johska'. Patchstack classified it as low priority with a low severity impact, noting it is unlikely to be exploited in targeted attacks. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Patchstack).