WordPress Plugin Vulnerabilities

Spice Blocks <= 2.0.7.6 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
spice-blocks
No known fix

References

CVE
CVE-2025-39532
URL
https://patchstack.com/database/wordpress/plugin/spice-blocks/vulnerability/wordpress-spice-blocks-2-0-7-1-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
0xd4rk5id3
Verified
No
WPVDB ID
83e44c3a-bc27-4f75-8b9a-4da0d0205518

Timeline

Publicly Published
2025-04-17 (about 1 year ago)
Added
2025-04-30 (about 1 year ago)
Last Updated
2026-01-14 (about 6 months ago)

Other

Published
Title
Published
2024-03-07
Title
affiliate-toolkit – WordPress Affiliate Plugin < 3.5.5 - Missing Authorization via atkp_create_list
Published
2024-04-17
Title
Shared Files < 1.7.17 - Missing Authorization to Notice Dismissal
Published
2025-09-10
Title
Ultimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Published
2026-06-29
Title
Woostify Sites Library <= 1.6.2 - Missing Authorization
Published
2021-12-08
Title
PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise