The Spectra Gutenberg Blocks plugin for WordPress enables an authenticated user with Contributor permission or higher to run arbitrary PHP code on the hosting server. By inserting a precisely crafted sequence of two blocks into post content, the attacker first registers a fake block type with a custom render_callback function. While rendering the second block of that same fake type on a subsequent request, call_user_func() calls the attacker‑supplied callback, resulting in remote code execution.

The vulnerability is present in all releases of the Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin distributed by brainstormforce, up to and including version 2.19.25. Any WordPress site that has this plugin installed and that allows contributors to edit or create posts is affected; no other products are listed as impacted.

With a CVSS score of 8.8 the flaw represents a high‑risk security issue. The EPSS score is not available, and it is not currently included in CISA’s KEV catalog. Exploitation requires only the ability to add or edit post content, a capability that is routinely granted to contributors. Because block rendering occurs during a normal page request, an attacker can trigger code execution without additional network exploitation, making the vulnerability easy to leverage in any environment where the plugin is active.