CVE-2026-16302: brainstormforce Spectra Legacy – Gutenberg Blocks

Описание

Оригинално описание

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.

Засегнати продукти

• brainstormforce Spectra Legacy – Gutenberg Blocks: до 2.20.0

Вид слабост

• CWE-200 Разкриване на чувствителна информация пред неоторизирана страна

История

Други уязвимости в brainstormforce Spectra Legacy – Gutenberg Blocks

• 6.5CVE-2026-92294
• 6.4CVE-2026-12900

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-16302
• https://nvd.nist.gov/vuln/detail/CVE-2026-16302
• https://www.wordfence.com/threat-intel/vulnerabilities/id/eede8a1e-db33-4c07-9991-9def75dddc87?source=cve
• https://plugins.trac.wordpress.org/changeset/3630074/