CVE-2025-8059

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8059", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-22T20:41:06.881Z", "datePublished": "2025-08-12T04:25:40.466Z", "dateUpdated": "2026-04-08T16:35:34.334Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:34.334Z"}, "affected": [{"vendor": "bplugins", "product": "bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role."}], "title": "B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee3b389-60c9-4f8e-9428-a71a6d9b20aa?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/b-blocks/trunk/includes/blocks/RegisterForm.php#L77"}, {"url": "https://wordpress.org/plugins/b-blocks/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3340770/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-08-06T12:25:10.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-11T16:24:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-12T16:01:35.001888Z", "id": "CVE-2025-8059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-12T16:01:52.109Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-12T16:01:35.001888Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-12T16:01:46.813Z"}}], "cna": {"title": "B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "bplugins", "product": "B Blocks \u2013 The ultimate block collection", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-06T12:25:10.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-11T16:24:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee3b389-60c9-4f8e-9428-a71a6d9b20aa?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/b-blocks/trunk/includes/blocks/RegisterForm.php#L77"}, {"url": "https://wordpress.org/plugins/b-blocks/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3340770/"}], "descriptions": [{"lang": "en", "value": "The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-08-12T04:25:40.466Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8059", "state": "PUBLISHED", "dateUpdated": "2025-08-12T16:01:52.109Z", "dateReserved": "2025-07-22T20:41:06.881Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-12T04:25:40.466Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection", "vendor": "bplugins", "versions": [{"lessThanOrEqual": "2.0.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role."}, {"lang": "es", "value": "El complemento B Blocks para WordPress es vulnerable a la escalada de privilegios debido a la falta de autorizaci\u00f3n y a una validaci\u00f3n de entrada incorrecta en la funci\u00f3n rgfr_registration() en todas las versiones hasta la 2.0.6 incluida. Esto permite que atacantes no autenticados creen una nueva cuenta y le asignen el rol de administrador."}], "id": "CVE-2025-8059", "lastModified": "2026-06-17T10:06:14.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8059", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-12T16:01:35.001888Z", "version": "2.0.3"}}]}, "published": "2025-08-12T05:15:32.487", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/b-blocks/trunk/includes/blocks/RegisterForm.php#L77"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3340770/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/b-blocks/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee3b389-60c9-4f8e-9428-a71a6d9b20aa?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:30:42.462027+00:00", "value": {"mitigation_remediation": ["Update the bBlocks plugin to the latest release (version 2.0.7 or later). If no update is available, remove or deactivate the plugin until an official fix is released.", "If an administrator account has already been created by an attacker, delete that account and reset any associated credentials.", "Review site logs for anomalous account creation events and establish monitoring for new administrator accounts."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Unauthenticated Access"}, "threat_synthesis": {"affected_systems": "All installations of the bBlocks plugin for WordPress up to and including version 2.0.6 are affected. The vulnerability applies to every user of bBlocks, regardless of role, as the registration endpoint does not enforce any authentication or role checks.", "description_and_impact": "The bBlocks WordPress plugin is vulnerable due to missing authorization checks and inadequate input handling in the rgfr_registration() function. This flaw allows an unauthenticated user to call the registration endpoint and create a new account that is granted administrator privileges. The attacker thereby obtains full administrative control over the WordPress site, enabling modification of content, installation of additional plugins, and data exfiltration. The weakness aligns with CWE\u2011862, representing an authorization flaw.", "risk_and_exploitability": "The flaw receives a CVSS score of 9.8, placing it in the \"Critical\" severity range. The EPSS score is reported as less than 1%, indicating a low but non\u2011zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but the combination of high severity, straightforward exploitation path, and the ability to generate privileged accounts makes this a high\u2011risk issue. An attacker only needs to construct a request to the rgfr_registration endpoint, with no prior privileges, to achieve escalation."}}}}, "created": "2025-08-12T07:36:51.837641+00:00", "updated": "2026-04-22T14:45:19.272237+00:00", "vendors": ["bplugins", "bplugins$PRODUCT$b_blocks", "wordpress", "wordpress$PRODUCT$wordpress"]}