CVE-2025-9376CWE-863broken-access-control

CVE-2025-9376

Medium · published August 28, 2025

CVSS v3.1

6.5

EPSS

Percentile

28.1

In the wild

Unconfirmed

What it is

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00356 · 28.1th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2025-08-28T16:15Z

References (4)

https://plugins.trac.wordpress.org/browser/stopbadbots/trunk/stopbadbots.php#L1958 · [email protected]https://plugins.trac.wordpress.org/changeset/3350927/ · [email protected]https://plugins.trac.wordpress.org/changeset/3351023/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6b0d86-3cb4-4723-b677-141c604f00cc?source=cve · [email protected]

EPSS history

Timeline

28 AUG 11:16Z
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass
cvelistv5