Spectra < 2.19.26 - Contributor+ Remote Code Execution via Block Attributes

Description

The plugin is vulnerable to Remote Code Execution. Exploitation requires a two-block payload embedded in post content: the first block registers a fake uagb/-prefixed block type with an attacker-specified render_callback, and the second block of the same fake type triggers invocation of that callback via call_user_func() during sequential block rendering in the same page request. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary code on the server.