Server-Side Request Forgery Vulnerability in Kadence WP Plugin for WordPress

CVE-2026-1857

What is CVE-2026-1857?

The Gutenberg Blocks with AI by Kadence WP plugin for WordPress has a vulnerability that allows authenticated users with Contributor-level access to exploit insufficient parameter validation in the GetResponse REST API's 'get_items()' function. This flaw permits unauthorized server-side requests to any endpoint on the GetResponse API, potentially extracting sensitive information such as contacts, campaigns, and mailing lists, all while exposing confidential API keys in request headers.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References