The Kadence Blocks plugin for WordPress contains a flaw in how it exposes editor assets. The editor_assets_variables includes a proData object that is injected into the browser as window.kadence_blocks_params. An authenticated user with contributor‑level permissions can open the block editor and inspect the console to read the entire proData payload, which contains the site’s Kadence license key, owner email, API key, API email, and license domain. This represents a sensitive information exposure; no additional exploitation or privilege escalation is required beyond existing contributor access.

The vulnerability affects the Kadence Blocks – Page Builder Toolkit for Gutenberg Editor plugin, developed by stellarwp, versions 3.7.5 and earlier. Anyone running a WordPress site that has installed Kadence Blocks up to and including 3.7.5, and has an administrator previously connected a valid Kadence license, is impacted. The bug is client‑side only; it does not require any server‑side manipulation or network traffic.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is below 1%, implying a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is purely informational and requires only contributor‑level access to the block editor, it is easy to exploit for any user who is already able to edit content. Attackers can simply open the block editor, view the browser console, and retrieve the sensitive key bundle.