CVE-2025-14360CWE-862

WordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerability

High · published January 8, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

⚡ A missing authorization check in Kaira Blockons can let users access restricted features without permission — like a party crasher slipping through the VIP entrance! 🎉 Imagine a restaurant that forgot to check if guests have the right reservation for the private dining room. Anyone could waltz in, enjoy the fancy menu, and potentially ruin the exclusivity for those who should actually be there! This vulnerability allows unauthorized users to access functionalities they shouldn’t be able to reach, possibly leading to sensitive data exposure or even manipulation of important settings. It's a serious security oversight that could leave your system at risk, and no one wants that!

Put simply

Imagine a restaurant that forgot to check if guests have the right reservation for the private dining room. Anyone could waltz in, enjoy the fancy menu, and potentially ruin the exclusivity for those who should actually be there! The missing authorization vulnerability in Kaira Blockons enables users to bypass access controls, effectively allowing them to perform actions without appropriate permissions. This affects all versions up to and including 1.2.19.

What to do

This vulnerability allows unauthorized users to access functionalities they shouldn’t be able to reach, possibly leading to sensitive data exposure or even manipulation of important settings. It's a serious security oversight that could leave your system at risk, and no one wants that! To protect your system, patch Kaira Blockons to the latest version and review your access control lists (ACLs) to ensure proper constraints are in place. Regular audits of user permissions can also help prevent any unauthorized access in the future. You've got this! By addressing this issue now, you'll ensure your system stays secure and your users remain protected. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-08T09:17Z
EPSS history
Timeline
  • 08 JAN 09:17Z
    WordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerability
    cvelistv5