The Kadence Blocks plugin for WordPress contains a missing authorization flaw that permits users to bypass configured access control levels. As a result, attackers who can interact with the plugin's backend or front‑end interfaces may gain access to administrative features, alter content, or perform actions normally restricted to higher‑privileged roles. The vulnerability is categorized as CWE‑862, indicating a flaw in proper enforcement of authorization checks.

WordPress sites using the StellarWP Gutenberg Blocks by Kadence Blocks plugin version 3.3.1 or earlier are impacted. The plugin is distributed as a WordPress plugin and interacts with standard WordPress roles and capabilities.

The CVSS score of 4.3 reflects a moderate impact with limited privilege escalation potential. The EPSS score of less than 1% suggests a low probability of automated exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s administrative views or REST endpoints, where an authenticated or unauthenticated user with sufficient privileges could exploit the missing checks. Based on the description, it is inferred that the vulnerability requires some level of user interaction or existing access to the site’s backend.