CVE-2025-22787
Published: 15 January 2025
Summary
CVE-2025-22787 is a medium-severity Missing Authorization (CWE-862) vulnerability in Bplugins Button Block. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-22787 is a missing authorization vulnerability (CWE-862) in the Button Block WordPress plugin developed by bPlugins. The flaw allows accessing functionality not properly constrained by access control lists (ACLs) and affects all versions of the plugin up to and including 1.1.5. Published on January 15, 2025, it has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), indicating low severity with primarily confidentiality impacts.
An authenticated attacker with low privileges, such as a contributor role, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited unauthorized access to sensitive data or functionality, resulting in low-impact confidentiality disclosure but no effects on integrity or availability.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/button-block/vulnerability/wordpress-button-block-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve) documents this broken access control issue in Button Block version 1.1.5. Security practitioners should consult this and any vendor updates for patching guidance and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2996
Vulnerability details
Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications by low-privilege authenticated users.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for access to system resources, addressing the missing authorization checks that allow low-privilege users to access restricted functionality in the Button Block plugin.
Implements least privilege to ensure low-privilege users like contributors cannot access sensitive data or functionality even if authorization checks are bypassed.
Requires timely identification, reporting, and remediation of flaws such as this missing authorization vulnerability in the WordPress plugin up to version 1.1.5.