CVE-2026-16302

Name of the Vulnerable Software and Affected Versions Spectra Legacy – Gutenberg Blocks versions prior to 2.20.1

Description Sensitive information exposure occurs via the editor assets() function, which exposes the uag insta linked accounts option through the uagb blocks info object without performing a capability check. Authenticated attackers with Contributor-level access or higher can extract sensitive data, including raw Instagram Graph API access tokens configured by an administrator. This issue requires the Spectra Pro plugin to be active and have a linked Instagram account.

Recommendations Update Spectra Legacy – Gutenberg Blocks to version 2.20.1 or later.