Unauthorized Data Access in Block Bad Bots Plugin for WordPress
CVE-2025-9376

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Block Bad Bots And Stop Bad Bots Crawlers And Spiders And Anti Spam Protection
Vendor
CVE Published:
28 August 2025

What is CVE-2025-9376?

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders plugin for WordPress suffers from a vulnerability allowing unauthorized data access. This is caused by an insufficient capability check in the 'stopbadbots_check_wordpress_logged_in_cookie' function. All versions up to and including 11.58 are affected, enabling unauthenticated attackers to bypass the plugin's blocklists, rate limits, and essential functionalities, potentially leading to serious security breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection * <= 11.58

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/stopbadbots/tr...
https://plugins.trac.wordpress.org/changeset/3350927/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jarno Vos
JSON
.