Security Alert Summary
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress contains a file deletion vulnerability that allows unauthenticated attackers to delete theme files on the server due to insufficient file path validation in the plugin’s __construct function. This affects all plugin versions up through 2.20.4.
CVE Details
- CVE ID:
CVE-2026-92294 - Affected plugin or component: Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress
- Affected versions: All versions up to and including 2.20.4
- Published: October 31, 2026 at 6:16:35 AM
- Last modified: October 31, 2026 at 6:16:35 AM
- CVSS v3.1: Base score 6.5 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Attack vector / complexity: Network / Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Primary impact: Confidentiality: None; Integrity: Low; Availability: Low
- CWE / weakness ID: CWE-862
Technical Details
The vulnerability is caused by insufficient file path validation in the plugin’s __construct function. Because the plugin does not properly validate or restrict file paths, an unauthenticated attacker can trigger limited file deletion operations that target theme files on the server. The description identifies the missing or inadequate validation in the constructor as the root cause.
The practical result is deletion of theme files, which can alter or break site presentation and may require restoring files from backups or reinstalling the theme. The issue does not report a confidentiality impact in the CVSS data, and there is no indication in the provided data that authenticated access or elevated privileges are required to exploit the specific deletion behavior.
How This Could Impact Your Website
In a typical small business WordPress site with multiple users, an unauthenticated attacker exploiting this vulnerability could delete theme files and cause partial or complete loss of the sites active theme assets. For example:
- The site owner notices layout breakage after a contractor uploads new templates; the deleted theme files prevent pages from rendering correctly for editors and visitors.
- Internal staff lose access to consistent styling and visual elements, disrupting content updates and marketing workflows.
- An external contributor finds that custom theme templates they rely on are missing, requiring time-consuming recovery from backups or redeployment.
Although the CVSS data indicates no direct confidentiality impact, disruption to site appearance and availability can increase the risk of targeted phishing or social engineering if attackers combine visual sabotage with other information-gathering techniques. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other accounts that can modify themes or files.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and file changes for unusual behavior; verify theme files against backups or repository copies.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L101
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L584
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-fse-fonts-compatibility.php#L93
- https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.21/classes/class-uagb-loader.php#L302
- https://plugins.trac.wordpress.org/changeset/3736176/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/60ad515a-3c0b-47f5-919b-0d17f693c049?source=cve
