CVE-2026-9227: GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter

Synopsis

Arbitrary file upload vulnerability in the GutenBee Gutenberg Blocks plugin for WordPress (versions up to and including 2.20.1) allows an authenticated attacker to upload executable files to the server. The flaw is reachable over the network and requires only a low-privilege (Author-level) WordPress account. Successful exploitation enables remote code execution on the host running the WordPress installation. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress instance via HTTP or HTTPS.

• AuthenticationRequired

  A valid WordPress account with Author-level privileges or higher is needed; any low-privilege authenticated user is sufficient to trigger the upload.

• Victim interactionNot required

  No action from another user or administrator is required; the attacker submits the malicious upload directly.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the bypass relies on a simple double-extension filename (e.g. shell.json.php) that consistently passes the flawed strpos() check with no race conditions or special environmental factors required.

Blast Radius

• The attacker can execute arbitrary code on the server hosting the WordPress installation, gaining full control of the web application process.
• Confidential data accessible to that process, including WordPress database credentials, stored user records, and session tokens, can be read directly.
• The attacker can modify or delete files within the web root and any writable paths, including theme files, plugin code, and uploaded media.
• The web server process can be crashed or monopolized, taking the WordPress site offline for legitimate users.