WordPress Plugin Vulnerabilities

Post and Page Builder by BoldGrid < 1.27.10 - Missing Authorization

Description

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.27.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
post-and-page-builder
Fixed in 1.27.10

References

CVE
CVE-2025-69345
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/98a953b9-60e1-4445-a61e-88d5867895eb

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
a0d2a99a-192d-4dc7-84b0-3aaa92e1fd30

Timeline

Publicly Published
2026-01-05 (about 4 months ago)
Added
2026-01-14 (about 3 months ago)
Last Updated
2026-01-14 (about 3 months ago)

Other

Published
Title
Published
2023-10-11
Title
IMPress Listings <= 2.6.2 - Missing Authorization
Published
2022-12-16
Title
ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup
Published
2024-01-05
Title
Booster Elite for WooCommerce < 7.1.2 - Missing Authorization to Order Information Disclosure
Published
2025-05-15
Title
Front End Users <= 3.2.35 - Unauthenticated Information Exposure
Published
2025-10-15
Title
Classified Pro < 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation