CVE-2025-12449

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12449", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T20:24:52.413Z", "datePublished": "2026-01-07T07:17:34.453Z", "dateUpdated": "2026-09-15T15:05:20.194Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-09-15T15:05:20.194Z"}, "affected": [{"vendor": "kodezen", "product": "aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The aBlocks \u2013 WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This makes it possible for authenticated attackers, with subscriber level access and above, to read plugin settings including block visibility, maintenance mode configuration, and third-party email marketing API keys, as well as read sensitive configuration data including API keys for email marketing services."}], "title": "aBlocks \u2013 WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c10600ae-1ff0-4f12-ae53-39d9342640f4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/ajax/settings.php#L16"}, {"url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/classes/abstract-request-handler.php#L486"}, {"url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/assets.php#L353"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&old=3269886&new_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&new=3401920"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "mahdi salhi (CaptinSharky01)"}], "timeline": [{"time": "2025-10-16T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-06T19:05:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:50:05.893571Z", "id": "CVE-2025-12449", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:13:10.787Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12449", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:50:05.893571Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:50:08.030Z"}}], "cna": {"title": "aBlocks \u2013 WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification", "credits": [{"lang": "en", "type": "finder", "value": "mahdi salhi (CaptinSharky01)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "kodezen", "product": "aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-16T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-06T19:05:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c10600ae-1ff0-4f12-ae53-39d9342640f4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/ajax/settings.php#L16"}, {"url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/classes/abstract-request-handler.php#L486"}, {"url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/assets.php#L353"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&old=3269886&new_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&new=3401920"}], "descriptions": [{"lang": "en", "value": "The aBlocks \u2013 WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This makes it possible for authenticated attackers, with subscriber level access and above, to read plugin settings including block visibility, maintenance mode configuration, and third-party email marketing API keys, as well as read sensitive configuration data including API keys for email marketing services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-09-15T15:05:20.194Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12449", "state": "PUBLISHED", "dateUpdated": "2026-09-15T15:05:20.194Z", "dateReserved": "2025-10-28T20:24:52.413Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T07:17:34.453Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder", "vendor": "kodezen", "versions": [{"lessThanOrEqual": "2.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The aBlocks \u2013 WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This makes it possible for authenticated attackers, with subscriber level access and above, to read plugin settings including block visibility, maintenance mode configuration, and third-party email marketing API keys, as well as read sensitive configuration data including API keys for email marketing services."}, {"lang": "es", "value": "El plugin aBlocks \u2013 WordPress Gutenberg Blocks para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos y a la divulgaci\u00f3n de informaci\u00f3n sensible debido a la falta de comprobaciones de capacidad en m\u00faltiples acciones AJAX en todas las versiones hasta la 2.4.0, inclusive. Esto permite a atacantes autenticados, con acceso de nivel de suscriptor y superior, leer la configuraci\u00f3n del plugin, incluyendo la visibilidad de los bloques, la configuraci\u00f3n del modo de mantenimiento y las claves API de marketing por correo electr\u00f3nico de terceros, as\u00ed como leer datos de configuraci\u00f3n sensibles, incluyendo claves API para servicios de marketing por correo electr\u00f3nico."}], "id": "CVE-2025-12449", "lastModified": "2026-09-15T16:17:07.203", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12449", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:50:05.893571Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:46.710", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/ajax/settings.php#L16"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/assets.php#L353"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/classes/abstract-request-handler.php#L486"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&old=3269886&new_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&new=3401920"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c10600ae-1ff0-4f12-ae53-39d9342640f4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:46:09.647076+00:00", "value": {"mitigation_remediation": ["Upgrade aBlocks to version 2.5.0 or later where the capability checks have been added.", "If an immediate upgrade is not possible, deactivate the plugin to stop access to the vulnerable AJAX endpoints.", "If deactivation is not feasible, restrict AJAX endpoint access to administrators by adding custom capability checks or using a security plugin."], "summary": {"action": "Apply Patch", "impact": "Missing authorization checks let authenticated users with Subscriber or higher level edit plugin settings and read sensitive API keys."}, "threat_synthesis": {"affected_systems": "All installations of kodezen\u2019s aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress up to and including version 2.4.0 are affected. The vulnerability exists across all WordPress sites that have not applied the latest plugin release.", "description_and_impact": "The aBlocks WordPress plugin suffers from absent capability checks on several AJAX actions. Authenticated users with a Subscriber role or higher can modify block visibility, maintenance mode, and other settings, and can read third\u2011party email marketing API keys. This lack of authorization enables the attacker to alter site behaviour and expose confidential configuration information, reflecting CWE\u2011862.", "risk_and_exploitability": "The CVSS score of 5.4 classifies this as a medium impact vulnerability. The EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not catalogued in CISA\u2019s KEV list. Because only authenticated access is required, the attack vector is internal; a user who can log in with Subscriber or higher privileges can trigger the vulnerable AJAX calls to read or change settings. No additional network or privilege escalation is required beyond normal authenticated access."}}}}, "created": "2026-01-08T09:49:43.216724+00:00", "updated": "2026-04-21T17:00:12.306394+00:00", "vendors": ["kodezen", "kodezen$PRODUCT$ablocks", "wordpress", "wordpress$PRODUCT$wordpress"]}