CVE-2026-1857: CWE-918 Server-Side Request Forgery (SSRF) in stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This is due to insufficient validation of the `endpoint` parameter in the `get_items()` function of the GetResponse REST API handler. The endpoint's permission check only requires `edit_posts` capability (Contributor role) rather than `manage_options` (Administrator). This makes it possible for authenticated attackers, with Contributor-level access and above, to make server-side requests to arbitrary endpoints on the configured GetResponse API server, retrieving sensitive data such as contacts, campaigns, and mailing lists using the site's stored API credentials. The stored API key is also leaked in the request headers.
AI Analysis
Technical Summary
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress contains an SSRF vulnerability (CVE-2026-1857) due to insufficient validation of the 'endpoint' parameter in the GetResponse REST API handler's get_items() function. The permission check is weak, requiring only 'edit_posts' capability, which is granted to Contributor-level users and above. This flaw allows authenticated users with limited privileges to perform server-side requests to arbitrary endpoints on the GetResponse API server using the site's stored API credentials. Sensitive information such as contacts, campaigns, mailing lists, and the API key itself may be exposed. The vulnerability affects all versions up to and including 3.6.1. The CVSS 3.1 score is 4.3 (medium severity). No patch or remediation details are currently available.
Potential Impact
Authenticated users with Contributor-level permissions or higher can exploit this SSRF vulnerability to make arbitrary server-side requests to the GetResponse API server configured in the plugin. This can lead to unauthorized disclosure of sensitive data including contacts, campaigns, mailing lists, and the API key stored by the site. The vulnerability does not impact system availability or integrity but compromises confidentiality of sensitive information accessible via the API.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level user permissions to trusted users only and monitor plugin updates from stellarwp for a security patch addressing this SSRF vulnerability.
CVE-2026-1857: CWE-918 Server-Side Request Forgery (SSRF) in stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Description
The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This is due to insufficient validation of the `endpoint` parameter in the `get_items()` function of the GetResponse REST API handler. The endpoint's permission check only requires `edit_posts` capability (Contributor role) rather than `manage_options` (Administrator). This makes it possible for authenticated attackers, with Contributor-level access and above, to make server-side requests to arbitrary endpoints on the configured GetResponse API server, retrieving sensitive data such as contacts, campaigns, and mailing lists using the site's stored API credentials. The stored API key is also leaked in the request headers.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress contains an SSRF vulnerability (CVE-2026-1857) due to insufficient validation of the 'endpoint' parameter in the GetResponse REST API handler's get_items() function. The permission check is weak, requiring only 'edit_posts' capability, which is granted to Contributor-level users and above. This flaw allows authenticated users with limited privileges to perform server-side requests to arbitrary endpoints on the GetResponse API server using the site's stored API credentials. Sensitive information such as contacts, campaigns, mailing lists, and the API key itself may be exposed. The vulnerability affects all versions up to and including 3.6.1. The CVSS 3.1 score is 4.3 (medium severity). No patch or remediation details are currently available.
Potential Impact
Authenticated users with Contributor-level permissions or higher can exploit this SSRF vulnerability to make arbitrary server-side requests to the GetResponse API server configured in the plugin. This can lead to unauthorized disclosure of sensitive data including contacts, campaigns, mailing lists, and the API key stored by the site. The vulnerability does not impact system availability or integrity but compromises confidentiality of sensitive information accessible via the API.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level user permissions to trusted users only and monitor plugin updates from stellarwp for a security patch addressing this SSRF vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-02-03T19:00:13.022Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6995672780d747be204d2939
Added to database: 2/18/2026, 7:15:51 AM
Last enriched: 4/9/2026, 10:01:15 PM
Last updated: 5/22/2026, 7:12:52 PM
Views: 102
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.