---
id: "CVE-2026-92294"
kind: "vulnerability"
aliases: ["CVE-2026-92294"]
title: "Spectra WordPress plugin: unauthenticated attackers can delete theme files"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "spectra-gutenberg-blocks", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-31T06:16:35+00:00"
first_seen_at: "2026-10-31T06:33:50+00:00"
updated_at: "2026-10-31T06:34:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92294", "first_seen_at": "2026-10-31T06:33:50+00:00"}]
---

# Spectra WordPress plugin: unauthenticated attackers can delete theme files

The Spectra Gutenberg Blocks plugin for WordPress fails to validate file paths in its constructor, up to and including version 2.20.4. An unauthenticated attacker can use this to delete theme files on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Spectra Gutenberg Blocks plugin in the WordPress admin under Plugins; affected if it is `2.20.4` or earlier.

## Fix

- Spectra Gutenberg Blocks: a fixed version is not stated in the sources.

## Timeline

- 2026-10-31T06:33:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92294

## From the sources

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_