Path Traversal Vulnerability in Spice Blocks by Spice Themes
CVE-2025-48130

7.5HIGH

Key Information:

Vendor

WordPress
Status
Spice Blocks
Vendor
CVE Published:
9 June 2025

What is CVE-2025-48130?

A vulnerability in Spice Blocks, developed by Spice Themes, permits path traversal attacks that could allow unauthorized file access. The issue arises from improper limitations on pathname handling, potentially enabling attackers to manipulate directories and access sensitive files. This vulnerability affects all versions of Spice Blocks up to 2.0.7.2, exposing users to risks of data compromise and integrity violations.

Affected Version(s)

Spice Blocks <= 2.0.7.2

References

https://patchstack.com/database/wordpress/plugin/spice-bl...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Martino Spagnuolo (r3verii) (Patchstack Alliance)
.