The Gutenberg Blocks with AI by Kadence WP plugin contains an insufficient validation of the endpoint parameter in the GetResponse REST API handler. Contributors and other authenticated users with the edit_posts capability can cause the server to request arbitrary URLs on the configured GetResponse API host, leaking the stored API key in request headers and exposing sensitive data such as contacts, campaigns, and mailing lists. The vulnerability does not provide arbitrary code execution but allows an attacker to obtain confidential information and a credential that may be usable in external services.

Kadence Blocks – Page Builder Toolkit for Gutenberg Editor, in the Gutenberg Blocks with AI plugin for WordPress, all versions up to and including 3.6.1 are affected. No newer version is known to contain a fix in the supplied data.

The CVSS score of 4.3 classifies the issue as moderate severity, and the EPSS score of less than 1% indicates a low likelihood of active exploitation at present. It is not listed in CISA’s KEV catalog. Exploitation requires authenticated access at the Contributor level or higher and a WordPress instance with the vulnerable plugin installed. Attackers can target the GetResponse API, retrieve data, and leak credentials, but the risk of widespread compromise is limited to the scope of the site’s data and any linked external services. No additional privileges or system-wide compromise are achievable through this flaw.