Sensitive Information Exposure in Kadence Blocks Plugin for WordPress

CVE-2026-11357

What is CVE-2026-11357?

The Kadence Blocks plugin for WordPress is prone to a vulnerability that exposes sensitive information through the editor assets variables. Authenticated users with contributor-level access can leverage this flaw to retrieve critical data, including the site's connected Kadence account license key, license owner email, API key, API email, and license domain. This information can be accessed from the browser console, specifically by inspecting the window.kadence_blocks_params.proData. Exploitation requires an administrator to have already connected a Kadence license, making it accessible to any contributor in the block editor environment, without the need for server-side request manipulation.

References