Page Blocks CVE-2025-9626

Exploitation requires that a site administrator with an active authenticated session to a WordPress site running Page Blocks ≤1.1.0 be socially engineered into clicking an attacker-controlled link or visiting a malicious page (UI:R). The vulnerable path is the admin_process_widget_page_change function, which lacks proper nonce validation, so a forged cross-origin request submitted in the admin's browser is accepted. Limiting factors: the target must be logged in as an admin at the time, the attacker must deliver the lure successfully, impact is confined to modifying widget page block configurations (no data theft or site takedown), and the attack cannot be automated at scale or run against an unauthenticated endpoint.

This is a genuinely low-priority issue despite a plausible-sounding attack vector. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) scores 4.3 (Medium), and the only real impact is a limited integrity hit (I:L) - modification of widget page block configurations - with no confidentiality or availability impact. The PR:N rating refers to the forged request carrying the victim's own authenticated session; exploitation still fundamentally requires tricking a logged-in administrator into clicking a link (UI:R), which is the dominant limiting factor. EPSS is very low at 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit has been identified, so this is not under active exploitation. CSRF against a plugin configuration function is low-value for attackers and hard to scale (requires a targeted social-engineering lure against a specific admin). No signals conflict here: low CVSS, low EPSS, no KEV, and no POC all point the same direction. The source code references (Wordfence threat intel and the exact trac lines around the vulnerable function) corroborate the missing-nonce root cause. Treat this as a patch-in-routine-cycle item, not an emergency.

An attacker crafts a malicious web page or email link containing a forged request that targets the admin_process_widget_page_change function of the Page Blocks plugin. When a logged-in WordPress administrator is lured into visiting the page, their browser silently submits the request using their active session, altering widget page block configurations without consent. No public exploit code has been identified, and success hinges entirely on the administrator being authenticated and taking the bait.