{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9634", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-28T20:05:57.726Z", "datePublished": "2025-09-11T07:24:55.037Z", "dateUpdated": "2026-04-08T16:59:00.776Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:00.776Z"}, "affected": [{"vendor": "jegerwan", "product": "Plugin updates blocker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub_save action handler. This makes it possible for unauthenticated attackers to disable or enable plugin updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Plugin updates blocker <= 0.2 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b66a0bc-9125-45ee-9583-bc503634a0ce?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/plugin-update-blocker/tags/0.2/dpu-menu.php#L3"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-09-10T18:44:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:03:38.334798Z", "id": "CVE-2025-9634", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:39:31.029Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9634", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:03:38.334798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:03:40.365Z"}}], "cna": {"title": "Plugin updates blocker <= 0.2 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "jegerwan", "product": "Plugin updates blocker", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:44:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b66a0bc-9125-45ee-9583-bc503634a0ce?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/plugin-update-blocker/tags/0.2/dpu-menu.php#L3"}], "descriptions": [{"lang": "en", "value": "The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub_save action handler. This makes it possible for unauthenticated attackers to disable or enable plugin updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-11T07:24:55.037Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9634", "state": "PUBLISHED", "dateUpdated": "2025-09-11T14:39:31.029Z", "dateReserved": "2025-08-28T20:05:57.726Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:55.037Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub_save action handler. This makes it possible for unauthenticated attackers to disable or enable plugin updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-9634", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-11T08:15:38.547", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/plugin-update-blocker/tags/0.2/dpu-menu.php#L3"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b66a0bc-9125-45ee-9583-bc503634a0ce?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:01:57.121048+00:00", "value": {"mitigation_remediation": ["Upgrade Plugin updates blocker to the latest release (>=0.3) that includes nonce validation for the pub_save action.", "If an upgrade is not possible, remove or disable the pub_save endpoint or the feature that allows toggling updates to eliminate the CSRF vector.", "Deploy an HTTP security rule (e.g., ModSecurity) to block POST requests to the pub_save URL that lack a valid nonce."], "summary": {"action": "Apply patch", "impact": "Unauthenticated CSRF allowing an attacker to change plugin update settings"}, "threat_synthesis": {"affected_systems": "Affecting the WordPress plugin \"Plugin updates blocker\" developed by jegerwan. All releases up to and including version 0.2 are vulnerable.", "description_and_impact": "The Plugin updates blocker plugin for WordPress is vulnerable to Cross\u2011Site Request Forgery because the pub_save action handler does not perform proper nonce validation or performs it incorrectly. This allows an unauthenticated attacker to trick a logged\u2011in administrator into clicking a crafted link, which will cause the administrator\u2019s session to execute the pub_save request and either enable or disable automatic plugin updates. The attacker can thus sabotage update processes or force updates to occur, impacting the maintenance and security posture of the site.", "risk_and_exploitability": "The CVSS v3.1 score of 4.3 indicates moderate risk, and the EPSS score of <1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is a CSRF request that an attacker can embed in a link or form, requiring the administrator to click or submit something while authenticated. The attack does not require any privilege escalation beyond being able to convince the target to perform the action."}}}}, "created": "2025-09-12T08:03:07.281875+00:00", "updated": "2026-04-21T03:15:16.325861+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}