{"id":"CVE-2026-92294","kind":"vulnerability","aliases":["CVE-2026-92294"],"related":[],"title":"Spectra WordPress plugin: unauthenticated attackers can delete theme files","description":"The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.","summary":"The Spectra Gutenberg Blocks plugin for WordPress fails to validate file paths in its constructor, up to and including version 2.20.4. An unauthenticated attacker can use this to delete theme files on the server.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","spectra-gutenberg-blocks","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Spectra Gutenberg Blocks plugin in the WordPress admin under Plugins; affected if it is `2.20.4` or earlier.","fix":"- Spectra Gutenberg Blocks: a fixed version is not stated in the sources.","status":"open","published_at":"2026-10-31T06:16:35+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:17+00:00","updated_at":"2026-10-31T06:34:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-31T06:34:17Z","model":"claude-haiku-5-5","output":{"fix":"- Spectra Gutenberg Blocks: a fixed version is not stated in the sources.","reach":"internet","title":"Spectra WordPress plugin: unauthenticated attackers can delete theme files","impact":"medium","summary":"The Spectra Gutenberg Blocks plugin for WordPress fails to validate file paths in its constructor, up to and including version 2.20.4. An unauthenticated attacker can use this to delete theme files on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","spectra-gutenberg-blocks","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker deletes theme files on the server","analyst_note":"Confirm the fixed plugin version and whether default configuration is exposed, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-92294.","how_to_check":"- Check the installed version of the Spectra Gutenberg Blocks plugin in the WordPress admin under Plugins; affected if it is `2.20.4` or earlier.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites with the Spectra Gutenberg Blocks plugin installed at version 2.20.4 or earlier are exposed. The sources do not say whether a non-default configuration is required. unknown for who can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":4144,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-92294':12A,15A '2.20.4':45B,95C 'attack':5A,48B,102C 'block':23B,28B,62C,67C 'builder':64C 'construct':86C 'constructor':39B 'cve':10A,13A 'delet':7A,53B,77C,104C 'due':78C 'editor':68C 'fail':32B 'file':9A,35B,55B,76C,81C,106C 'function':87C 'gutenberg':22B,27B,61C 'host':19B 'includ':43B,94C 'insuffici':80C 'limit':75C 'make':97C 'packag':16B 'path':36B,82C 'plugin':3A,29B,69C 'possibl':99C 'self':18B 'self-host':17B 'server':58B,109C 'spectra':1A,21B,26B,60C 'spectra-gutenberg-block':20B 'theme':8A,54B,105C 'unauthent':4A,47B,101C 'use':50B 'valid':34B,83C 'version':44B,90C 'vulner':73C 'websit':63C 'wordpress':2A,24B,31B,71C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Spectra Gutenberg Blocks plugin installed at version 2.20.4 or earlier are exposed. The sources do not say whether a non-default configuration is required. unknown for who can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92294","severity":null,"published_at":"2026-10-31T06:16:35+00:00","modified_at":"2026-10-31T06:16:35+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}