Unauthorized Data Access in GenerateBlocks Plugin for WordPress

CVE-2025-11879

What is CVE-2025-11879?

The GenerateBlocks plugin for WordPress contains a vulnerability that allows unauthorized access to sensitive user data. This issue arises from a missing capability check in the 'get_option_rest' function, present in all versions up to and including 2.1.1. Authenticated attackers with contributor-level access or higher can exploit this weakness to read arbitrary WordPress options, potentially exposing sensitive information like SMTP credentials and API keys stored by various plugins. Without appropriate safeguards, this vulnerability increases the risk of data breaches in WordPress sites utilizing the affected plugin.

References