CVE-2025-12449CWE-862broken-access-control

CVE-2025-12449

Medium · published January 7, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This makes it possible for authenticated attackers, with subscriber level access and above, to read plugin settings including block visibility, maintenance mode configuration, and third-party email marketing API keys, as well as read sensitive configuration data including API keys for email marketing services.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-07T17:16Z
References (5)
https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/ajax/settings.php#L16 · [email protected]https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/assets.php#L353 · [email protected]https://plugins.trac.wordpress.org/browser/ablocks/tags/2.4.0/includes/classes/abstract-request-handler.php#L486 · [email protected]https://plugins.trac.wordpress.org/changeset?old_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&old=3269886&new_path=/ablocks/trunk/includes/classes/abstract-request-handler.php&new=3401920 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/c10600ae-1ff0-4f12-ae53-39d9342640f4?source=cve · [email protected]
EPSS history
Timeline
  • 07 JAN 07:17Z
    aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification
    cvelistv5