Arbitrary File Upload Vulnerability in GutenBee Plugin for WordPress

CVE-2026-9227

What is CVE-2026-9227?

The GutenBee – Gutenberg Blocks plugin for WordPress contains a vulnerability that allows authenticated attackers with author-level access or higher to upload arbitrary files. This security flaw arises from an inadequate substring check within the gutenbee_file_and_ext_json function. Instead of ensuring that the file names conclude with the .json extension, the check merely looks for the presence of '.json' within the filename. This oversight permits the use of double-extension filenames, such as shell.json.php, effectively bypassing validation protocols. Consequently, this vulnerability exposes sites to the risk of remote code execution, highlighting the critical need for secure file upload mechanisms.

References