Sensitive Information Exposure in Spectra Legacy – Gutenberg Blocks Plugin for WordPress

CVE-2026-16302

What is CVE-2026-16302?

The Spectra Legacy – Gutenberg Blocks plugin for WordPress contains a vulnerability that allows authenticated users, specifically those with Contributor-level access, to access sensitive information. This issue arises from the improper handling of the uag_insta_linked_accounts option through the editor_assets function, which does not enforce necessary capability checks. As a consequence, attackers can potentially extract sensitive data such as raw Instagram Graph API access tokens set up by the site administrator. The vulnerability affects all versions of the plugin up to and including 2.20.0 and requires that the Spectra Pro plugin is active with a linked Instagram account for exploitation.

References