PT-2025-34988 · WordPress · Stopbadbots+1

Jarno Vos · Publicado 2025-08-28 · Atualizado 2025-08-28 · CVE-2025-9376

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress versions through 11.58

Description: The plugin is susceptible to unauthorized data access due to an inadequate capability check within the stopbadbots check wordpress logged in cookie function. This allows unauthenticated attackers to circumvent security measures such as blocklists and rate limits.

Recommendations: Update the plugin to a version beyond 11.58.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2025-9376

Produtos afetados

Block Bad Bots

Stopbadbots

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/8d6b0d86-3cb4-4723-b677-141c604f00cc?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/stopbadbots/trunk/stopbadbots.php#L1958 · Nota
• https://plugins.trac.wordpress.org/changeset/3350927 · Nota
• https://plugins.trac.wordpress.org/changeset/3351023 · Nota
• https://twitter.com/VulmonFeeds/status/1961049617816023453 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-9376 · Nota de Segurança
• https://twitter.com/CVEnew/status/1961030558747705721 · Publicação no Twitter