Input validation vulnerability in Spectra – WordPress Gutenberg Blocks 2.6.6

The Spectra plugin for WordPress is vulnerable to a type of cyber attack known as Server-Side Request Forgery. This type of attack is possible in versions of the plugin up to and including 2.6.6. It can be done using something called the import_wpforms function. Attackers who have been granted access to the website with permissions that are at least as high as a contributor can make web requests to external locations. This can be used to get and change information from services that are inside the web application.