{"id":"CVE-2026-125802","kind":"vulnerability","aliases":["CVE-2026-125802"],"related":[],"title":"Spectra WordPress block plugin: sensitive data embedded in responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5.","summary":"Spectra (ultimate-addons-for-gutenberg), a WordPress block plugin by Brainstorm Force, sends sensitive information inside data it returns, so an attacker can retrieve embedded sensitive data. Affected versions are listed as all releases through 2.20.5.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","spectra","ultimate-addons-for-gutenberg","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Spectra (Ultimate Addons for Gutenberg) plugin version in the WordPress admin under Plugins.\n- Compare the installed version against `2.20.5`; anything at or below it is in the reported range.","fix":"- Spectra (ultimate-addons-for-gutenberg): move to a version later than `2.20.5`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:49:04+00:00","updated_at":"2026-11-13T15:49:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:49:04Z","model":"claude-haiku-5-5","output":{"fix":"- Spectra (ultimate-addons-for-gutenberg): move to a version later than `2.20.5`; the exact fixed version is unknown from the sources.","reach":"internet","title":"Spectra WordPress block plugin: sensitive data embedded in responses","impact":"medium","summary":"Spectra (ultimate-addons-for-gutenberg), a WordPress block plugin by Brainstorm Force, sends sensitive information inside data it returns, so an attacker can retrieve embedded sensitive data. Affected versions are listed as all releases through 2.20.5.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","spectra","ultimate-addons-for-gutenberg"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive data embedded in plugin responses","analyst_note":"Find the fixed Spectra version and the affected endpoint from the Wordfence or vendor advisory, since the NVD entry gives no fix or exposure detail.","how_to_check":"- Check the installed Spectra (Ultimate Addons for Gutenberg) plugin version in the WordPress admin under Plugins.\n- Compare the installed version against `2.20.5`; anything at or below it is in the reported range.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Spectra (Ultimate Addons for Gutenberg) WordPress plugin at version 2.20.5 or earlier are in the reported range. The sources do not describe which data path or configuration exposes the information, so the exact exposure conditions are unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4547,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125802':12A,15A '-2026':11A,14A '2.20.5':60B,89C 'addon':20B,27B,75C 'affect':52B,84C 'allow':78C 'attack':46B 'block':3A,32B 'brainstorm':35B,70C 'cve':10A,13A 'data':6A,41B,51B,67C 'data.this':82C 'embed':7A,49B,80C 'forc':36B,71C 'gutenberg':22B,29B,77C 'inform':39B,64C 'insert':61C 'insid':40B 'issu':83C 'list':55B 'n/a':87C 'packag':16B 'plugin':4A,33B 'releas':58B 'respons':9A 'retriev':48B,79C 'return':43B 'send':37B 'sensit':5A,38B,50B,63C,81C 'sent':66C 'spectra':1A,17B,24B,72C,85C 'ultim':19B,26B,74C 'ultimate-addons-for-gutenberg':18B,25B,73C 'version':53B 'vulner':68C 'wordpress':2A,23B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Spectra (Ultimate Addons for Gutenberg) WordPress plugin at version 2.20.5 or earlier are in the reported range. The sources do not describe which data path or configuration exposes the information, so the exact exposure conditions are unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","spectra","ultimateaddonsforgutenberg","wordpress"],"campaign_type":null,"search_a":"'-125802':12A,15A '-2026':11A,14A 'block':3A 'cve':10A,13A 'data':6A 'embed':7A 'plugin':4A 'respons':9A 'sensit':5A 'spectra':1A 'wordpress':2A","search_b":"'2.20.5':60B 'addon':20B,27B 'affect':52B 'attack':46B 'block':32B 'brainstorm':35B 'data':41B,51B 'embed':49B 'forc':36B 'gutenberg':22B,29B 'inform':39B 'insid':40B 'list':55B 'packag':16B 'plugin':33B 'releas':58B 'retriev':48B 'return':43B 'send':37B 'sensit':38B,50B 'spectra':17B,24B 'ultim':19B,26B 'ultimate-addons-for-gutenberg':18B,25B 'version':53B 'wordpress':23B,31B","search_c":"'2.20.5':89C 'addon':75C 'affect':84C 'allow':78C 'brainstorm':70C 'data':67C 'data.this':82C 'embed':80C 'forc':71C 'gutenberg':77C 'inform':64C 'insert':61C 'issu':83C 'n/a':87C 'retriev':79C 'sensit':63C,81C 'sent':66C 'spectra':72C,85C 'ultim':74C 'ultimate-addons-for-gutenberg':73C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125802","severity":null,"published_at":"2026-11-13T15:17:40+00:00","modified_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}