CVE-2026-9227
HighSummary
The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 2.20.1 due to a flawed filename validation. Authenticated attackers with author-level access can upload executable files, enabling remote code execution.
Risk Assessment
The organization is at risk of remote code execution by authenticated attackers, which could lead to serious security breaches and data loss.
Recommendation
It is recommended to update the GutenBee plugin to the latest version to mitigate this vulnerability and to review and restrict access for users with author-level permissions.
Original NVD description (English source)
The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_and_ext_json function. This is due to a flawed strpos() substring check that only verifies whether the filename contains the string '.json' rather than confirming the filename ends with a .json extension, allowing double-extension filenames like shell.json.php to bypass validation. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible.