CVE-2025-26871

Medium

Published: 25 February 2025

Published

25 February 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS Score 0.0011 28.2th percentile

Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26871 is a medium-severity Missing Authorization (CWE-862) vulnerability in Wpdeveloper Essential Blocks. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-26871 is a missing authorization vulnerability (CWE-862) in the Essential Blocks for Gutenberg WordPress plugin by WPDeveloper. The issue stems from exploiting incorrectly configured access control security levels and affects all versions of the plugin from n/a through 4.8.3. It has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), indicating medium severity with network accessibility, low attack complexity, and low privilege requirements.

A low-privileged authenticated attacker, such as a WordPress user with contributor or similar access, can exploit this vulnerability remotely without user interaction. Exploitation enables limited unauthorized modifications to plugin resources (low integrity impact), potentially allowing alterations to blocks or settings that the attacker should not access.

The Patchstack advisory details the broken access control issue in version 4.8.3 and recommends updating the Essential Blocks for Gutenberg plugin to a patched version beyond 4.8.3 as the primary mitigation. Further details are available at https://patchstack.com/database/Wordpress/Plugin/essential-blocks/vulnerability/wordpress-essential-blocks-plugin-4-8-3-broken-access-control-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-5384

Vulnerability details

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The missing authorization vulnerability in the public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) by low-privileged authenticated attackers to perform unauthorized modifications to plugin resources.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0