Description
Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.
Published: 2025-09-22
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Missing authorization in the WordPress Smart Blocks plugin (v1.x up to 2.4) allows an attacker to bypass configured security levels and execute actions that should be restricted. The flaw is a classic broken access control (CWE‑862) that can lead to unauthorized access to data or functions, potentially compromising confidentiality and integrity of the site.

Affected Systems

The vulnerability affects the Smart Blocks plugin from hashthemes, all releases up to and including version 2.4. Sites that have any of these versions installed are impacted.

Risk and Exploitability

The score of 4.3 indicates a low to medium severity, and the EPSS score of less than 1 % signals a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw resides in a WordPress plugin, it is inferred that the attack vector is web‑based and likely requires an authenticated user or an attacker able to inject requests into the plugin’s endpoints.

Generated by OpenCVE AI on April 30, 2026 at 00:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Smart Blocks plugin to the latest available release that contains the remediation (for example, any version greater than 2.4).
  • Configure WordPress user roles so that only administrators or users with the necessary privileges can access the Smart Blocks features, thereby limiting the scope of the broken access control.
  • Disable or remove the Smart Blocks plugin on any site that does not need it until a patched version is released.

Generated by OpenCVE AI on April 30, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-30479 Missing Authorization vulnerability in hashthemes Smart Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Blocks: from n/a through 2.4.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in hashthemes Smart Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Blocks: from n/a through 2.4. Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Tue, 23 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 23 Sep 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 22 Sep 2025 18:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in hashthemes Smart Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Blocks: from n/a through 2.4.
Title WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:52.522Z

Reserved: 2025-09-17T18:00:53.704Z

Link: CVE-2025-59561

cve-icon Vulnrichment

Updated: 2025-09-23T13:35:54.616Z

cve-icon NVD

Status : Deferred

Published: 2025-09-22T19:16:24.333

Modified: 2026-04-23T15:34:03.910

Link: CVE-2025-59561

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T00:30:23Z

Weaknesses