{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9626", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-28T19:19:01.503Z", "datePublished": "2025-10-11T09:28:38.732Z", "dateUpdated": "2026-04-08T17:02:09.160Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:09.160Z"}, "affected": [{"vendor": "softwud", "product": "Page Blocks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Page Blocks <= 1.1.0 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L705"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L710"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/page_blocks_plugin.php#L96"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sandeep"}], "timeline": [{"time": "2025-10-10T20:40:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T18:32:02.675811Z", "id": "CVE-2025-9626", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T18:45:38.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9626", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T18:32:02.675811Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T18:32:03.562Z"}}], "cna": {"title": "Page Blocks <= 1.1.0 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Sandeep"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "softwud", "product": "Page Blocks", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-10T20:40:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L705"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L710"}, {"url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/page_blocks_plugin.php#L96"}], "descriptions": [{"lang": "en", "value": "The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:09.160Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9626", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:09.160Z", "dateReserved": "2025-08-28T19:19:01.503Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-11T09:28:38.732Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-9626", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-10-11T10:15:44.810", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L705"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L710"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-blocks/trunk/page_blocks_plugin.php#L96"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:44:40.081027+00:00", "value": {"mitigation_remediation": ["Upgrade Page Blocks to a version newer than 1.1.0 to remove the CSRF flaw.", "If updating is not immediately possible, configure the web server or firewall to reject POST or GET requests to the admin_process_widget_page_change endpoint.", "Educate site administrators to be cautious of suspicious links and limit administrative access to trusted personnel."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Request Forgery allowing unauthenticated modification of widget page block configurations"}, "threat_synthesis": {"affected_systems": "Any WordPress installation that uses Page Blocks version 1.1.0 or earlier is affected. The plugin is commonly employed to manage layout blocks, so administrators who have not upgraded are at risk.", "description_and_impact": "The Page Blocks plugin for WordPress has a CSRF flaw in the admin_process_widget_page_change function because nonce validation is missing or incorrect. The weakness lets an unauthenticated attacker submit a forged request that an administrator will accept if the admin follows a malicious link. By doing so, attackers can alter widget page block configurations, potentially changing the site\u2019s appearance or functionality. The vulnerability is mapped to CWE\u2011352.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. Exploitation requires only that an administrator unknowingly click a crafted link while authenticated; an attacker needs no special technical access beyond the admin\u2019s session token. The flaw stems from the plugin\u2019s failure to verify the required nonce."}}}}, "created": "2025-10-21T13:12:31.827518+00:00", "updated": "2026-04-22T00:45:04.165661+00:00", "vendors": ["softwud", "softwud$PRODUCT$page_blocks", "wordpress", "wordpress$PRODUCT$wordpress"]}