{"id":"CVE-2026-92294","aliases":[],"cve":{"records":[{"id":"CVE-2026-92294","source":"Wordfence","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-16T00:25:47.490Z","published":"2026-10-31T05:33:07.751Z","modified":"2026-11-03T19:02:04.839Z"}],"publishers":[{"name":"Wordfence","role":"CNA","organizationId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","modified":"2026-10-31T05:33:07.751Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-03T19:02:04.839Z"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ad515a-3c0b-47f5-919b-0d17f693c049?source=cve","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L101","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L93","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L584","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-loader.php#L302","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/changeset/3736176/","tags":[],"source":"Wordfence"}],"weaknesses":[{"id":"CWE-862","description":"CWE-862 Missing Authorization","source":"Wordfence"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-03T19:01:55.369822Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters","titleSource":"Wordfence","descriptionSource":"Wordfence","description":"The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.","score":6.5,"severity":"medium","published":"2026-10-31T05:33:07.751Z","modified":"2026-11-03T19:02:04.839Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"brainstormforce","name":"Spectra Legacy – Gutenberg Blocks","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.20.4","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Wordfence","url":"https://www.cve.org/CVERecord?id=CVE-2026-92294"}],"remediation":[],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/60ad515a-3c0b-47f5-919b-0d17f693c049?source=cve","https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L101","https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L93","https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L584","https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-loader.php#L302","https://plugins.trac.wordpress.org/changeset/3736176/"],"sources":[{"name":"CVE","id":"CVE-2026-92294","modified":"2026-11-03T19:02:04.839Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-92294"}],"assessments":[{"source":"Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-03T19:29:49.678Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:40:32.333Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-31T06:45:34.396Z","attemptedAt":"2026-10-31T06:45:34.396Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-31T06:45:34.558Z","attemptedAt":"2026-10-31T06:45:34.558Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-31T06:45:34.750Z","attemptedAt":"2026-10-31T06:45:34.750Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-31T06:45:34.313Z","attemptedAt":"2026-10-31T06:45:34.313Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-92294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92294","modified":"2026-10-31T06:16:35.153","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-10-31T06:45:34.396Z"},{"source":"GitHub Advisory Database","id":"GHSA-2mm6-8x3p-cx55","url":"https://github.com/advisories/GHSA-2mm6-8x3p-cx55","modified":"2026-10-31T06:30:35Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-10-31T06:45:34.558Z"}],"aiSummary":{"text":"Spectra Gutenberg Blocks versions up to 2.20.4 have a missing authorization weakness, allowing unauthenticated attackers to delete limited theme files via GET parameters. The vulnerability is due to insufficient file path validation. Impact is limited theme file deletion and modification.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T06:31:10.310Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-92294"}]}}