CVE-2025-9376

{
  "id": "CVE-2025-9376",
  "sourceIdentifier": "[email protected]",
  "published": "2025-08-28T12:15:39.280",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality."
    },
    {
      "lang": "es",
      "value": "El plugin Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection para WordPress es vulnerable a acceso no autorizado a datos debido a una verificación de capacidad insuficiente en la función 'stopbadbots_check_wordpress_logged_in_cookie' en todas las versiones hasta, e incluyendo, la 11.58. Esto hace posible que atacantes no autenticados eludan las listas de bloqueo, los límites de tasa y otras funcionalidades del plugin."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sminozzi",
          "product": "Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "11.58",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-08-28T13:35:10.304505Z",
          "id": "CVE-2025-9376",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/stopbadbots/trunk/stopbadbots.php#L1958",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3350927/",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3351023/",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6b0d86-3cb4-4723-b677-141c604f00cc?source=cve",
      "source": "[email protected]"
    }
  ]
}