CVE-2025-12182: Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize
The Qi Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the resizeimagecallback() function in all versions up to, and including, 1.4.3. This is due to the plugin not properly verifying that a user has permission to resize a specific attachment. This makes it possible for authenticated attackers, with Contributor-level access and above, to resize arbitrary media library images belonging to other users, which can result in unintended file writes, disk consumption, and server resource abuse through processing of large images.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12182?
CVE-2025-12182 has a medium severity due to unauthorized access risk.
How do I fix CVE-2025-12182?
To fix CVE-2025-12182, upgrade the Qi Blocks plugin to version 1.4.4 or higher.
What is the impact of CVE-2025-12182?
CVE-2025-12182 allows unauthorized users to resize images without proper permissions.
Which versions are affected by CVE-2025-12182?
CVE-2025-12182 affects all versions of the Qi Blocks plugin up to and including 1.4.3.
Is there a patch available for CVE-2025-12182?
Yes, a patch is available in Qi Blocks version 1.4.4 which resolves the vulnerability.