CVE-2025-14158
CSRF Vulnerability in Coding Blocks WordPress Plugin Allows Settings Manipulation
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | coding_blocks_plugin | 1.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Coding Blocks plugin for WordPress, affecting all versions up to and including 1.1.0. It occurs because the plugin's settings update functionality lacks nonce validation, allowing an attacker to trick a site administrator into performing unwanted actions, such as changing plugin settings or theme configuration, by sending a forged request.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to modify plugin settings or theme configuration without authentication by tricking an administrator into clicking a malicious link. This can lead to unauthorized changes in the website's behavior or appearance, potentially compromising site integrity or user experience.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Coding Blocks plugin for WordPress to a version later than 1.1.0 where the nonce validation issue is fixed. Additionally, avoid clicking on suspicious links and ensure that only trusted administrators have access to update plugin settings.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the Coding Blocks plugin version 1.1.0 or earlier and if the plugin's settings update functionality is accessible without proper nonce validation. Since the vulnerability involves Cross-Site Request Forgery (CSRF) on the plugin's settings update via POST requests, detection can involve monitoring for unexpected POST requests to the plugin's settings page that update configuration options without valid nonce tokens. Specific commands to detect this might include inspecting web server logs for POST requests to the plugin's settings URL (e.g., /wp-admin/admin.php?page=coding-blocks-settings or similar) and checking for the presence or absence of nonce parameters. For example, using grep on access logs to find suspicious POST requests: 1. `grep 'POST' /var/log/apache2/access.log | grep 'coding-blocks'` 2. `grep 'POST' /var/log/nginx/access.log | grep 'coding-blocks'` Additionally, using tools like curl to test if the settings update endpoint accepts POST requests without nonce validation could help confirm the vulnerability. However, no specific detection commands are provided in the resources. [2, 3]