CVE-2025-59561

Vulnerability

Overview The Smart Blocks plugin for WordPress versions up to and including 2.4 suffers from a missing authorization vulnerability. This issue arises from the absence of proper access control checks, allowing exploitation of incorrectly configured access control security levels [1].

Exploitation

Attackers can exploit this broken access control without needing elevated privileges, as the plugin fails to enforce authorization or nonce token checks in certain functions [1]. This makes it possible for unprivileged users to execute actions intended for higher-privileged users, potentially targeting thousands of websites in mass-exploit campaigns [1].

Impact

Successful exploitation can lead to unauthorized actions being performed on affected WordPress sites, compromising the integrity of the site's functionality [1]. The vulnerability is rated as low severity but is still a vector for mass exploitation.

Mitigation

The vendor has released version 2.5 to address the issue. Users are strongly advised to update the plugin immediately [1]. For Patchstack users, enabling auto-updates for vulnerable plugins is recommended [1].