Cyber Posture

CVE-2025-26871

Medium

Published: 25 February 2025

Published
25 February 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0011 28.3th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26871 is a missing authorization vulnerability (CWE-862) in the Essential Blocks for Gutenberg WordPress plugin by WPDeveloper. The issue stems from exploiting incorrectly configured access control security levels and affects all versions of the plugin from n/a through 4.8.3. It has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, and low privilege requirements.

A low-privileged authenticated attacker, such as a WordPress user with contributor or similar access, can exploit this vulnerability remotely without user interaction. Exploitation enables limited unauthorized modifications to plugin resources (low integrity impact), potentially allowing alterations to blocks or settings that the attacker should not access.

The Patchstack advisory details the broken access control issue in version 4.8.3 and recommends updating the Essential Blocks for Gutenberg plugin to a patched version beyond 4.8.3 as the primary mitigation. Further details are available at https://patchstack.com/database/Wordpress/Plugin/essential-blocks/vulnerability/wordpress-essential-blocks-plugin-4-8-3-broken-access-control-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-862

Affected Products

wpdeveloper
essential blocks
≤ 4.8.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The missing authorization vulnerability in the public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) by low-privileged authenticated attackers to perform unauthorized modifications to plugin resources.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References