CVE-2026-15286

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks with AI by Kadence WP – Page Builder Features versions prior to 3.5.33

Description An issue exists that allows authenticated users with Contributor-level access or higher to create and immediately publish posts of any type, including pages. This occurs because of a misconfigured capability check within the get items permission check() function, which serves as the permission callback for the 'process pattern' REST API endpoint. This flaw allows attackers to bypass the standard review workflow that typically requires administrator approval for contributor submissions.

Recommendations Update the plugin to version 3.5.33 or later.