WordPress Plugin Vulnerabilities

ZoloBlocks < 2.3.12 - Missing Authorization to Unauthenticated Popup Enable/Disable

Description

The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_popup_status() function in all versions up to, and including, 2.3.11. This makes it possible for unauthenticated attackers to enable/disable popups.

Affects Plugins

Plugin icon
zoloblocks
Fixed in 2.3.12

References

CVE
CVE-2025-12134
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/da9f89a2-f816-4445-8aea-11b622451ee9

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Jay
Verified
No
WPVDB ID
9c5afd9c-54b0-455d-add5-9eb08810176a

Timeline

Publicly Published
2025-10-23 (about 8 months ago)
Added
2025-10-23 (about 8 months ago)
Last Updated
2025-10-29 (about 8 months ago)

Other

Published
Title
Published
2026-01-03
Title
Prowess <= 1.8.1 - Missing Authorization
Published
2024-08-12
Title
Icegram < 3.1.25 - Missing Authorization
Published
2024-06-21
Title
Page Builder Sandwich – Front-End Page Builder <= 5.1.0 - Missing Authorization
Published
2025-12-20
Title
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX < 5.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Published
2025-12-12
Title
HAPPY – Helpdesk Support Ticket System < 1.0.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply