Unauthorized Data Modification in ZoloBlocks for WordPress
CVE-2025-12134
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 October 2025
What is CVE-2025-12134?
The ZoloBlocks plugin for WordPress is susceptible to unauthorized data modification due to a missing capability check in the update_popup_status() function. This vulnerability allows unauthenticated attackers to manipulate popup settings, enabling or disabling popups without proper permissions. All versions of the plugin up to and including 2.3.11 are affected, posing significant risk to users relying on this plugin for their WordPress sites. It is essential for users to promptly update to the latest version and review security measures to mitigate potential exploits.
Affected Version(s)
ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns * <= 2.3.11