The Spectra Legacy – Gutenberg Blocks plugin contains a flaw that omits a capability check in the editor_assets function. This allows an authenticated user with Contributor level or higher to read the uag_insta_linked_accounts option from the uagb_blocks_info JavaScript object exposed to the editor. This reveals raw Instagram Graph API access tokens and related configuration data that an administrator has stored in WordPress. An attacker who can obtain these tokens can impersonate the account, read or modify Instagram data, and potentially perform further exploitations that depend on the confirmed ownership of the Instagram account. The vulnerability has a confidentiality impact but does not provide direct code execution, privilege escalation, or denial of service. The flaw is confined to the WordPress CMS and specifically the Spectra Legacy plugin; it cannot be leveraged by unauthenticated visitors.

This issue affects the WordPress plugin Spectra Legacy – Gutenberg Blocks in all releases up to and including version 2.20.0. The vulnerability is only exploitable when the companion Spectra Pro plugin is active and an Instagram account is linked through that plugin, regardless of the WordPress installation’s configuration.

The CVSS score of 4.3 indicates a moderate risk level. The Exploit Prediction Scoring System score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it has not been widely exploited in the wild. Potential attackers would need legitimate Contributor or higher privileges on the WordPress site and must have the Spectra Pro plugin enabled with an Instagram connection. The required attack vector is the web application layer, specifically by loading the editor page that serves the unprotected uagb_blocks_info payload. The combination of authentication requirements and plugin dependency reduces the overall likelihood, though the sensitivity of the data exposed elevates the importance of mitigation.