Cyber Resilience

CVE-2025-14360

High

Published: 08 January 2026

Published
08 January 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0004 12.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14360 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-14360 is a missing authorization vulnerability (CWE-862) in the Kaira Blockons WordPress plugin, which allows attackers to access functionality not properly constrained by access control lists (ACLs). This issue affects Blockons versions from n/a through 1.2.19. Published on 2026-01-08, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high severity driven by significant confidentiality impact.

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation enables access to restricted functionality, resulting in high confidentiality consequences, such as unauthorized exposure of sensitive data, while integrity and availability remain unaffected.

The Patchstack advisory provides further details on this broken access control issue in the Blockons plugin, including mitigation guidance, accessible at https://patchstack.com/database/Wordpress/Plugin/blockons/vulnerability/wordpress-blockons-plugin-1-2-15-broken-access-control-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2.19.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authorization in public-facing WordPress plugin directly enables unauthenticated network exploitation of internet-facing application for sensitive data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-45209Shared CWE-862
CVE-2026-25026Shared CWE-862
CVE-2026-42083Shared CWE-862
CVE-2026-0656Shared CWE-862
CVE-2026-24532Shared CWE-862
CVE-2025-13603Shared CWE-862
CVE-2025-69063Shared CWE-862
CVE-2026-3045Shared CWE-862
CVE-2025-67956Shared CWE-862
CVE-2025-41765Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces approved authorizations for access to system resources, directly preventing exploitation of missing ACL constraints in the Blockons plugin.

prevent

Requires identification, reporting, and correction of flaws like the missing authorization in Blockons versions through 1.2.19, eliminating the vulnerability root cause.

prevent

Applies least privilege to limit access to restricted functionality, reducing unauthorized data exposure even with incomplete authorization enforcement.

References