The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress contains an authorization flaw in the 'get_items_permission_check' function used as a permission callback for the 'process_pattern' REST API endpoint. This misconfiguration permits authenticated users with Contributor-level privileges or above to create and publish posts directly, bypassing the standard WordPress workflow that requires administrator approval for contributors. The issue affects all versions up to and including 3.5.32. There is no vendor advisory or patch information available at this time.

Authenticated attackers with Contributor-level access or higher can immediately publish posts of any type, including pages, without administrator approval. This bypasses the intended review process, potentially allowing unauthorized content publication. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access carefully and monitor for suspicious post publications. Avoid granting Contributor or higher privileges to untrusted users.