PT-2025-47039 · WordPress · Qi Blocks

Adrian Lukita · Published 2025-11-15 · Updated 2025-11-15 · CVE-2025-12182

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Qi Blocks versions prior to 1.4.4

Description The Qi Blocks plugin for WordPress has a flaw that allows unauthorized access due to a missing capability check on the resize image callback() function. This occurs because the plugin does not verify if a user has the necessary permission to resize a specific attachment. Authenticated attackers with Contributor-level access or higher can resize media library images belonging to other users. This can lead to unintended file writes, increased disk consumption, and server resource abuse through the processing of large images.

Recommendations Update Qi Blocks to version 1.4.4 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-12182

Affected Products

Qi Blocks

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12182 · Security Note
• https://t.me/CVEtracker/37397 · Telegram Post
• https://twitter.com/CVEnew/status/1989543300970291352 · Twitter Post
• https://plugins.trac.wordpress.org/browser/qi-blocks/tags/1.4.3/inc/media/class-qi-blocks-media.php#L138 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/41b0b12f-ff52-4913-aa54-3fbaf0839959?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3387712/qi-blocks/trunk/inc/media/class-qi-blocks-media.php · Note
• https://twitter.com/VulmonFeeds/status/1989576061328232527 · Twitter Post