What is the CVSS score of CVE-2026-25429?

CVE-2026-25429 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nexa Blocks are affected by CVE-2026-25429?

CVE-2026-25429 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2026-25429?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Nexa Blocks CVE-2026-25429

EUVD-2026-15724 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-p9qh-h9cj-hc7v

Deserialization Nexa Blocks

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15724

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

AnalysisAI

A PHP Object Injection vulnerability exists in the Nexa Blocks WordPress plugin (versions up to and including 1.1.1) due to unsafe deserialization of untrusted data, allowing attackers to instantiate arbitrary PHP objects and potentially achieve remote code execution. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and affects all installations of the affected plugin versions. While no CVSS score or EPSS data are currently available, the nature of object injection vulnerabilities combined with PHP's magic methods provides significant exploitation potential for code execution or privilege escalation.

Technical ContextAI

The vulnerability stems from improper handling of serialized PHP objects within the Nexa Blocks plugin (CPE: cpe:2.3:a:wpdive:nexa_blocks:*:*:*:*:*:*:*:*). PHP object injection occurs when user-controlled input is passed to the unserialize() function without proper validation or sanitization. This violates CWE-502, which addresses the deserialization of untrusted data. Attackers can craft malicious serialized payloads that, when deserialized, instantiate objects with gadget chains—sequences of class methods and magic methods (such as __construct, __destruct, __toString, __call) that execute unintended code. In the context of WordPress plugins like Nexa Blocks, the attack surface typically includes data from POST requests, cookies, or stored database records that are not properly validated before deserialization.

RemediationAI

Immediately update the Nexa Blocks plugin to a patched version beyond 1.1.1 if available from the plugin developer or WordPress.org repository. Check the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/nexa-blocks/vulnerability/wordpress-nexa-blocks-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cve for patch availability and timeline. As an interim mitigation, disable the Nexa Blocks plugin entirely until a patch is released, or restrict administrative access to WordPress backend functions that might trigger the vulnerable deserialization routine. Additionally, implement input validation and sanitization at the application level, configure PHP's disable_classes and disable_functions directives to restrict dangerous object instantiation, and monitor WordPress logs for suspicious serialized data patterns. Consider using a Web Application Firewall (WAF) rule to detect and block requests containing suspicious PHP serialization payloads.