Cross-Site Request Forgery in Page Blocks Plugin for WordPress

CVE-2025-9626

What is CVE-2025-9626?

The Page Blocks plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.1.0. This security flaw arises from inadequate nonce validation in the admin_process_widget_page_change function, allowing unauthorized attackers to alter widget page block settings. The attacker can exploit this by deceiving a site administrator into clicking a manipulated link, leading to unauthorized modifications without the administrator's consent.

References