PT-2026-1578 · WordPress · Wordpress+1

Mahdi Salhi · Publicado 2026-01-07 · Atualizado 2026-01-07 · CVE-2025-12449

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions aBlocks – WordPress Gutenberg Blocks plugin versions prior to 2.4.1

Description The aBlocks – WordPress Gutenberg Blocks plugin for WordPress has a flaw that allows unauthorized modification of data and disclosure of sensitive information. This is due to missing capability checks on multiple AJAX actions. Authenticated attackers with subscriber level access or higher can read plugin settings, including block visibility and maintenance mode configuration. They can also access sensitive configuration data, such as API keys for email marketing services. The API keys are particularly vulnerable to exposure.

Recommendations Update to version 2.4.1 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-12449

Produtos afetados

Wordpress

Ablocks – Wordpress Gutenberg Blocks

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/c10600ae-1ff0-4f12-ae53-39d9342640f4?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/ajax/settings.php#L16 · Nota
• https://twitter.com/CVEnew/status/2008807432449929300 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/assets.php#L353 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12449 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/classes/abstract-request-handler.php#L486 · Nota