CVE-2025-9376

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/stopbadbots/trunk/stopbadbots.php#L1958
https://plugins.trac.wordpress.org/changeset/3350927/
https://plugins.trac.wordpress.org/changeset/3351023/
https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6b0d86-3cb4-4723-b677-141c604f00cc?source=cve

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El plugin Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection para WordPress es vulnerable a acceso no autorizado a datos debido a una verificación de capacidad insuficiente en la función 'stopbadbots_check_wordpress_logged_in_cookie' en todas las versiones hasta, e incluyendo, la 11.58. Esto hace posible que atacantes no autenticados eludan las listas de bloqueo, los límites de tasa y otras funcionalidades del plugin.

Information

Published : 2025-08-28 12:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-9376

Mitre link : CVE-2025-9376

CVE.ORG link : CVE-2025-9376

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-9376", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9376", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-28T13:35:10.304505Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "sminozzi", "product": "Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "11.58"}], "defaultStatus": "unaffected"}]}], "published": "2025-08-28T12:15:39.280", "references": [{"url": "https://plugins.trac.wordpress.org/browser/stopbadbots/trunk/stopbadbots.php#L1958", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3350927/", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3351023/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6b0d86-3cb4-4723-b677-141c604f00cc?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality."}, {"lang": "es", "value": "El plugin Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection para WordPress es vulnerable a acceso no autorizado a datos debido a una verificaci\u00f3n de capacidad insuficiente en la funci\u00f3n 'stopbadbots_check_wordpress_logged_in_cookie' en todas las versiones hasta, e incluyendo, la 11.58. Esto hace posible que atacantes no autenticados eludan las listas de bloqueo, los l\u00edmites de tasa y otras funcionalidades del plugin."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "security@wordfence.com"}