Description
Missing Authorization vulnerability in creativethemeshq Blocksy blocksy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blocksy: from n/a through <= 2.0.97.
Published: 2025-05-07
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a missing authorization check in the Blocksy theme, which can allow users without proper privileges to perform actions reserved for higher-level roles. It is inferred that an attacker with any account could access or modify theme settings and potentially inject content or alter site appearance. This is a classic broken access control flaw, classified as CWE‑862.

Affected Systems

WordPress installations that use the Blocksy theme up to and including version 2.0.97 are vulnerable. The vulnerability applies to all versions from an unspecified starting point through 2.0.97. Versions newer than 2.0.97 are not affected.

Risk and Exploitability

The CVSS score of 4.9 denotes moderate severity, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an authenticated user accessing the theme’s configuration interface and exploiting the missing authorization check to elevate privileges; this is inferred from the description.

Generated by OpenCVE AI on May 1, 2026 at 08:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Blocksy theme to the latest available release, which resolves the missing authorization flaw.
  • Restrict non-administrator roles from accessing theme options, ensuring that only administrators can modify theme settings.
  • If a timely update is not possible, disable the Blocksy theme in the production environment to prevent exploitation.

Generated by OpenCVE AI on May 1, 2026 at 08:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-13852 Missing Authorization vulnerability in CreativeThemes Blocksy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blocksy: from n/a through 2.0.97.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in CreativeThemes Blocksy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blocksy: from n/a through 2.0.97. Missing Authorization vulnerability in creativethemeshq Blocksy blocksy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blocksy: from n/a through <= 2.0.97.
Title WordPress Blocksy <= 2.0.97 - Broken Access Control Vulnerability WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerability
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'}

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00035}

 epss

{'score': 0.00036}

Wed, 07 May 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 May 2025 14:30:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in CreativeThemes Blocksy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blocksy: from n/a through 2.0.97.
Title WordPress Blocksy <= 2.0.97 - Broken Access Control Vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Creativethemes Blocksy
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:42.018Z

Reserved: 2025-05-07T09:38:48.853Z

Link: CVE-2025-47465

cve-icon Vulnrichment

Updated: 2025-05-07T17:21:19.498Z

cve-icon NVD

Status : Deferred

Published: 2025-05-07T15:16:00.580

Modified: 2026-04-23T15:30:16.210

Link: CVE-2025-47465

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T09:00:12Z

Weaknesses