GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_and_ext_json function. This is due to a flawed strpos() substring check that only verifies whether the filename contains the string '.json' rather than confirming the filename ends with a .json extension, allowing double-extension filenames like shell.json.php to bypass validation. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cssigniterteam | GutenBee – Gutenberg Blocks | up to 2.20.1 | — | No fix listed | CNA |
- GutenBee – Gutenberg Blocks Vendorcssigniterteam Affected up to 2.20.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9227
- 2026-10-03 Alias added: GHSA-fxjg-wrwj-m45j
References
Other 9
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2d20e8c9-975d-4e8c-8bea-50935853c7d4?source=cve
- https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L571
- https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L570
- https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.1/gutenbee.php#L579
- https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L571
- https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L570
- https://plugins.trac.wordpress.org/browser/gutenbee/tags/2.20.0/gutenbee.php#L579
- https://github.com/cssigniter/gutenbee/commit/bde934cdecf67a4de1d6548cc1fc6c59bc6690e5
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3543574%40gutenbee&new=3543574%40gutenbee&sfp_email=&sfph_mail=
More cssigniterteam vulnerabilities
- TI-2026-07627 Authorization bypass in cssigniterteam AudioIgniter Music Player CVSS 3.1HIGH 7.5
- TI-2024-31669 WordPress MaxSlider plugin <= 1.2.3 - Local File Inclusion vulnerability CVSS 3.1HIGH 7.5
- TI-2024-21352 WordPress Elements Plus! plugin <= 2.16.3 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2025-07952 Elements Plus! <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVSS 3.1MEDIUM 6.4
- TI-2025-07845 GutenBee – Gutenberg Blocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
- TI-2024-02170 Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links CVSS 3.1MEDIUM 6.4
Sources
- CVE-2026-9227 · CVE Program
- CVE-2026-9227 · NVD
- FIRST EPSS
- GHSA-fxjg-wrwj-m45j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences