CVE-2026-2826 is an authorization bypass vulnerability (CWE-862) in the Kadence Blocks — Page Builder Toolkit for Gutenberg Editor WordPress plugin. The issue arises because the process_pattern REST API endpoint fails to verify that the requesting user has the upload_files capability. This flaw allows authenticated users with contributor or higher privileges to upload images by providing remote URLs, which the server downloads and adds to the WordPress Media Library. The vulnerability affects all versions up to and including 3.6.3. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Authenticated users with contributor-level access or higher can bypass authorization controls to upload arbitrary images to the WordPress Media Library. This could allow unauthorized content insertion or manipulation within the media library, potentially leading to content integrity issues. The vulnerability does not affect confidentiality or availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for unusual media uploads. Avoid granting upload_files capability to untrusted users. No official patch or temporary fix is currently documented.