The Kadence Blocks plugin for WordPress suffers from an authorization bypass that can be classified as CWE‑862 (Missing Authorization). When the REST API endpoint responsible for processing pattern requests receives a request to upload a remote image, it does not verify that the user possesses the 'upload_files' capability. As a result, any authenticated user with at least contributor level can supply a URL, cause the server to download the image, and create a media attachment in the Media Library without proper authorization.

The affected product is Kadence Blocks – Page Builder Toolkit for Gutenberg Editor from StellarWP. All versions up to and including 3.6.3 contain the flaw; it was fixed in version 3.6.4 and later.

The CVSS base score of 4.3 indicates moderate severity and no evidence of remote code execution or privilege escalation. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with contributor-level permissions or higher; the only requirement is access to the REST API endpoint to supply a remote image URL. The risk lies in the ability to inject arbitrary media, which could be used to publish malicious content or disrupt site operations.