CVE-2025-59561: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WordPress Smart Blocks plugin affecting all versions up to and including 2.4. The vulnerability was reported on September 5, 2025, and publicly disclosed on September 22, 2025. The issue was assigned CVE-2025-59561 and affects the hashthemes Smart Blocks WordPress plugin (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue, resulting from a missing capability check on a function. It received a CVSS v3.1 score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability requires Contributor-level access or higher to exploit (Rapid7, Patchstack).

The vulnerability allows authenticated attackers with Contributor-level access or higher to perform unauthorized actions. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 2.5 of the Smart Blocks plugin. Users are advised to update to version 2.5 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).