CVE-2026-9227 is an arbitrary file upload vulnerability in the GutenBee – Gutenberg Blocks plugin for WordPress. The vulnerability arises from the function gutenbee_file_and_ext_json, which uses a flawed strpos() check that only confirms if the filename contains the substring '.json' rather than ensuring the filename ends with '.json'. This allows bypass via double extensions like 'shell.json.php'. Authenticated users with author-level privileges or higher can exploit this to upload potentially executable files, enabling remote code execution. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the author level, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the vendor advisory or patch links.

An attacker with author-level access or higher can upload files with dangerous extensions that bypass the plugin's validation, potentially leading to remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system. The vulnerability is rated high severity with a CVSS score of 8.8. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user permissions carefully and monitor for suspicious file uploads. Avoid granting author-level access to untrusted users. Consider disabling or replacing the GutenBee plugin if possible to mitigate risk.