CVE-2026-42648

MediumCVSS 4.3

Published: 29/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Spectra through version 2.19.22.

Risk Assessment

An unauthorized person may perform actions covered by plugin features that should be protected by access control. This may lead to unauthorized changes in the WordPress site.

Recommendation

Update the Spectra plugin to a version newer than 2.19.22, which contains the fix.

Other vulnerabilities in Spectra

CVE-2026-119520Medium
The Spectra (ultimate-addons-for-gutenberg) plugin by Brainstorm Force in versions up to and including 2.20.4 is vulnerable to Stored Cross-Site Scripting due to improper neutralization of input during web page generation. Attackers can inject malicious scripts that are stored and executed by users visiting the site.

Original NVD description (English source)

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.22.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS