Live › vulnerability › CVE-2026-92294
The Spectra Gutenberg Blocks plugin for WordPress fails to validate file paths in its constructor, up to and including version 2.20.4. An unauthenticated attacker can use this to delete theme files on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
WordPress sites with the Spectra Gutenberg Blocks plugin installed at version 2.20.4 or earlier are exposed. The sources do not say whether a non-default configuration is required. unknown for who can skip it.
No product ranges from the sources yet.
2.20.4 or earlier.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-92294")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.