CVE-2025-11879: GenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure
The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getoptionrest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11879?
CVE-2025-11879 has a medium severity rating due to the potential for unauthorized data access by authenticated attackers.
How do I fix CVE-2025-11879?
To fix CVE-2025-11879, update the GenerateBlocks plugin to version 2.1.2 or later, where the capability check has been implemented.
Who is affected by CVE-2025-11879?
CVE-2025-11879 affects users of the GenerateBlocks plugin for WordPress running versions up to and including 2.1.1.
What kind of access is required to exploit CVE-2025-11879?
To exploit CVE-2025-11879, an attacker must have authenticated access with contributor-level permissions.
What is the impact of CVE-2025-11879?
The impact of CVE-2025-11879 allows attackers to access sensitive data without proper authorization.