CVE-2026-15286 is an incorrect authorization vulnerability (CWE-863) in the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor WordPress plugin by stellarwp. The vulnerability arises from a misconfigured capability check on the 'get_items_permission_check' function used as a permission callback for the 'process_pattern' REST API endpoint. This flaw allows authenticated users with Contributor-level permissions or higher to create and immediately publish posts of any type, including pages, bypassing the normal WordPress workflow that requires administrator approval for contributors' posts. The issue affects all plugin versions up to and including 3.5.32. There is no vendor advisory or patch information available at this time.

Authenticated users with Contributor-level access or above can bypass the intended post publication workflow and publish posts immediately without administrator approval. This could lead to unauthorized content being published on the affected WordPress site. The vulnerability does not impact confidentiality or availability but impacts integrity by allowing unauthorized content publication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access carefully and monitor for unauthorized post publications. No official fix or temporary workaround has been documented in the provided data.