CVE-2026-7465: Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

Synopsis

This is an authenticated remote code execution flaw in the Spectra Gutenberg Blocks WordPress plugin, affecting all versions up to and including 2.19.25. An attacker with a Contributor account or higher can reach the vulnerable rendering path over the network by submitting post content containing a crafted two-block payload: the first block registers a fake uagb-prefixed block type with an attacker-chosen render_callback, and the second invokes it through call_user_func during sequential block rendering. Successful exploitation runs arbitrary PHP on the server, giving full read, write, and service-disruption capability. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site over the network to submit post content through the editor or REST API.

• AuthenticationRequired

  A Contributor-level WordPress account (or higher) is required to author the malicious post containing the two-block payload.

• Victim interactionNot required

  No victim action is needed; the render_callback fires during normal block rendering in the same request.

• Attack complexityDetail

  Attack complexity is low: the two-block payload is deterministic and triggers reliably during sequential block rendering.

Blast Radius

• Executes arbitrary PHP under the web server account, which typically means full control of the WordPress application.
• Reads stored secrets, database credentials from wp-config.php, session tokens, and any customer data the site holds.
• Modifies posts, user roles, plugin code, and persisted database rows, enabling persistent backdoors and privilege escalation to administrator.
• Can disrupt or take the site offline by deleting files, exhausting resources, or pivoting to other services reachable from the web host.