CVE-2025-8059CRITICAL 9.8EPSS p35.4%
CVE-2025-8059CVE-2025-8059
Description
The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role.
Scoring
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 0.45% probability of exploitation · percentile 35.4% · 2026-06-19T12:03:05Z |
| Published | 2025-08-12 |
| Last modified | 2026-04-15 |
Underlying weaknesses· 1
References
- https://plugins.trac.wordpress.org/browser/b-blocks/trunk/includes/blocks/RegisterForm.php#L77
- https://plugins.trac.wordpress.org/changeset/3340770/
- https://wordpress.org/plugins/b-blocks/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee3b389-60c9-4f8e-9428-a71a6d9b20aa?source=cve
1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Missing Authorizationcwe-862 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.