CVE-2025-9626

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9626", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-28T19:19:01.503Z", "datePublished": "2025-10-11T09:28:38.732Z", "dateUpdated": "2026-04-08T17:02:09.160Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:09.160Z"}, "affected": [{"vendor": "softwud", "product": "Page Blocks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Page Blocks <= 1.1.0 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L705"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L710"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/page_blocks_plugin.php#L96"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sandeep"}], "timeline": [{"time": "2025-10-10T20:40:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T18:32:02.675811Z", "id": "CVE-2025-9626", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T18:45:38.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9626", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T18:32:02.675811Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T18:32:03.562Z"}}], "cna": {"title": "Page Blocks <= 1.1.0 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Sandeep"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "softwud", "product": "Page Blocks", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-10T20:40:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L705"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L710"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/page_blocks_plugin.php#L96"}], "descriptions": [{"lang": "en", "value": "The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:09.160Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9626", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:09.160Z", "dateReserved": "2025-08-28T19:19:01.503Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-11T09:28:38.732Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Page Blocks", "vendor": "softwud", "versions": [{"lessThanOrEqual": "1.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Page Blocks para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.1.0, inclusive. Esto se debe a una validaci\u00f3n de nonce ausente o incorrecta en la funci\u00f3n admin_process_widget_page_change. Esto hace posible que atacantes no autenticados modifiquen las configuraciones de los bloques de p\u00e1gina de widgets a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-9626", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9626", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T18:32:02.675811Z", "version": "2.0.3"}}]}, "published": "2025-10-11T10:15:44.810", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L705"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L710"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/page_blocks_plugin.php#L96"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:44:40.081027+00:00", "value": {"mitigation_remediation": ["Upgrade Page Blocks to a version newer than 1.1.0 to remove the CSRF flaw.", "If updating is not immediately possible, configure the web server or firewall to reject POST or GET requests to the admin_process_widget_page_change endpoint.", "Educate site administrators to be cautious of suspicious links and limit administrative access to trusted personnel."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Request Forgery allowing unauthenticated modification of widget page block configurations"}, "threat_synthesis": {"affected_systems": "Any WordPress installation that uses Page Blocks version 1.1.0 or earlier is affected. The plugin is commonly employed to manage layout blocks, so administrators who have not upgraded are at risk.", "description_and_impact": "The Page Blocks plugin for WordPress has a CSRF flaw in the admin_process_widget_page_change function because nonce validation is missing or incorrect. The weakness lets an unauthenticated attacker submit a forged request that an administrator will accept if the admin follows a malicious link. By doing so, attackers can alter widget page block configurations, potentially changing the site\u2019s appearance or functionality. The vulnerability is mapped to CWE\u2011352.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. Exploitation requires only that an administrator unknowingly click a crafted link while authenticated; an attacker needs no special technical access beyond the admin\u2019s session token. The flaw stems from the plugin\u2019s failure to verify the required nonce."}}}}, "created": "2025-10-21T13:12:31.827518+00:00", "updated": "2026-04-22T00:45:04.165661+00:00", "vendors": ["softwud", "softwud$PRODUCT$page_blocks", "wordpress", "wordpress$PRODUCT$wordpress"]}