The Kadence Blocks – Page Builder Toolkit for Gutenberg Editor contains a misconfigured permission check (CWE‑863) in the REST API function that handles pattern processing. This flaw allows any authenticated user with the Contributor role or higher to create and publish posts immediately, bypassing the standard WordPress approval workflow. The result is that privileged users can inject content or updates without administrator oversight, potentially compromising site integrity and compliance requirements. Based on the description, the vulnerability is specifically tied to the 'process_pattern' endpoint; this detail is inferred from the function name referenced in the source code links.

Any WordPress installation running Kadence Blocks version 3.5.32 or older. The vulnerability is specific to the 'process_pattern' REST API endpoint in the plugin and affects all content types that can be created through the Gutenberg editor. This includes posts, pages, and any custom post types supported by WordPress.

The CVSS score of 4.3 and an EPSS score of less than 1% suggest limited public exploitation potential. The flaw requires the attacker to be an authenticated user with Contributor or higher access, which is inferred from the mention of misconfigured capability check. The likely attack vector involves sending a simple authenticated HTTP request to the 'process_pattern' endpoint, as implied by the code references. Since the endpoint accepts any post type and immediately publishes it, successful exploitation results in unauthorized content publication without additional prerequisites.