Security Flaw in ShopEngine Gutenberg WooCommerce Builder Blocks Addon for WordPress
CVE-2026-92396
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 November 2026
Badges
What is CVE-2026-92396?
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon for WordPress, prior to version 2.4.4, contains a security vulnerability in its AJAX actions. This flaw arises from inadequate validation of user capabilities and the ownership of targeted posts. Specifically, it fails to ensure that users with minimal privileges, such as contributors, cannot inject arbitrary scripts into posts. When these posts are later edited by users with higher privileges, the injected scripts can execute, which poses significant security risks.
Affected Version(s)
ShopEngine Gutenberg WooCommerce Builder Blocks Addon 0 < 2.4.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.