CVE-2026-7465

Vulnerability

The Spectra Gutenberg Blocks plugin (ultimate-addons-for-gutenberg) versions up to and including 2.19.25 contain a remote code execution vulnerability in the block rendering mechanism. The plugin allows dynamic registration of block types with a uagb/ prefix. An attacker can craft a post containing two blocks: the first block registers a fake block type with an attacker-controlled render_callback parameter, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request [1][2][3][4]. No special configuration is required beyond the default plugin installation.

Exploitation

An authenticated attacker with at least Contributor-level access (who can create and edit posts) can embed the two-block payload in post content. The first block uses the plugin's block registration logic to define a new block type with a render_callback pointing to arbitrary PHP code. The second block, of the same fake type, causes the plugin to call call_user_func() on that callback during rendering. The attack requires no additional user interaction beyond viewing the post (or the attacker triggering the render). The payload is executed server-side when the post is rendered.

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the server, leading to full remote code execution. This can result in complete compromise of the WordPress site, including data theft, site defacement, or further lateral movement. The attacker gains the ability to run commands, read/write files, and potentially escalate privileges.

Mitigation

The vendor has not yet released a patched version as of the publication date (2026-05-30). Users should disable the plugin or restrict Contributor-level access until a fix is available. The plugin is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog at this time. Monitor the plugin's update channel for a version beyond 2.19.25.