PT-2025-37022 · WordPress · Wp Blast | Seo & Performance Booster

Nabil Irawan · Published 2025-09-10 · Updated 2025-09-10 · CVE-2025-9622

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WP Blast | SEO & Performance Booster plugin for WordPress versions up to and including 1.8.6

Description: The WP Blast | SEO & Performance Booster plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on multiple administrative actions within the Settings class. This allows unauthenticated attackers to trigger actions such as cache purging, sitemap clearing, plugin data purging, and score resetting by tricking a site administrator into performing an action.

Recommendations: Update the WP Blast | SEO & Performance Booster plugin to a version newer than 1.8.6.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-9622

Affected Products

Wp Blast | Seo & Performance Booster

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-9622 · Security Note
• https://twitter.com/VulmonFeeds/status/1965696970728538532 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357450%40wpblast&new=3357450%40wpblast&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L914 · Note
• https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L930 · Note
• https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L922 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b8954061-cb8f-49fc-84d9-50851f7f48a2?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L906 · Note
• https://twitter.com/CVEnew/status/1965691852864254283 · Twitter Post