CVE-2026-92294
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Oct 31, 2026
CISA due date
—
The record
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability… CWE-862
- CVE-2026-121730 emailflare before commit cf31f33 contains a missing authorization vulnerability in POST… CWE-862
- CVE-2026-121729 emailflare before commit cf31f33 contains a missing authorization vulnerability in the… CWE-862
- CVE-2026-116663 Tanium addressed an improper access controls vulnerability in Enforce. CWE-862
- CVE-2026-121253 Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
- CVE-2026-121251 Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-862
- CVE-2026-121194 Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
- CVE-2026-121199 Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38… CWE-862