Cyber Posture

CVE-2025-2303

High

Published: 22 March 2025

Published
22 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0220 84.5th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Security Summary

CVE-2025-2303 is a remote code execution (RCE) vulnerability in the Block Logic – Full Gutenberg Block Display Control plugin for WordPress, affecting all versions up to and including 1.0.8. The flaw resides in the block_logic_check_logic function, which performs unsafe evaluation of user-controlled input, as classified under CWE-94 (Improper Control of Generation of Code). Published on 2025-03-22, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high severity due to its potential for complete server compromise.

Authenticated attackers with Contributor-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. By supplying malicious input to the affected function, they can execute arbitrary code on the WordPress server, potentially leading to full control over the hosting environment, data exfiltration, or further lateral movement.

Advisories and patches are detailed in provided references: the vulnerable code appears at line 127 in the plugin's 1.0.8 tag on the WordPress trac, a fix is implemented in changeset 3430763, and Wordfence's threat intelligence page offers additional analysis and mitigation guidance for this CVE.

Details

CWE(s)
CWE-94

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

RCE via unsafe eval of user input in public-facing WordPress plugin directly maps to T1190 for exploitation; enables arbitrary code execution on server mapping to T1059 Command and Scripting Interpreter.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References