Unauthorized Data Modification in aBlocks WordPress Plugin
CVE-2025-12449

5.4MEDIUM

Key Information:

Vendor: WordPress
Status: Ablocks – WordPress Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & GSAP Animation Builder
Vendor: CVE Published:; 7 January 2026

What is CVE-2025-12449?

The aBlocks plugin for WordPress exposes serious security flaws due to inadequate capability checks on numerous AJAX actions across all versions up to 2.4.0. These vulnerabilities enable authenticated attackers, including those with subscriber access or higher, to manipulate plugin settings and access sensitive information. This includes critical configuration details such as block visibility settings, maintenance mode configurations, and third-party email marketing API keys, posing significant risks to data integrity and user privacy.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

aBlocks – WordPress Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & GSAP Animation Builder * <= 2.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/ablocks/tags/2...

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jan 7, 2026
Vulnerability Reserved
Oct 28, 2025

Credit

mahdi salhi

JSON

WordPress