CVE-2025-8676: 
WordPress vulnerability analysis and mitigation

CVE-2025-8676 is a Sensitive Information Exposure vulnerability in the B Slider – Gutenberg Slider Block for WP plugin for WordPress, affecting versions 2.0.0 and earlier. The flaw exists in the get_active_plugins function and allows authenticated attackers with subscriber-level access or higher to enumerate installed plugins on the target WordPress site. It was published on August 15, 2025, with the assigner listed as Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The get_active_plugins function in the plugin's admin menu code (adminMenu.php) does not enforce adequate access controls, allowing any authenticated user — including those with only subscriber-level privileges — to invoke it and retrieve a list of all active plugins installed on the WordPress instance. This information disclosure occurs over the network without requiring any special interaction from an administrator. Source code for the vulnerable implementation is visible in the plugin's Trac repository (WordPress Trac).

Successful exploitation allows an authenticated low-privileged attacker to enumerate all active plugins on the WordPress site, which can reveal the site's software stack and expose plugins with known vulnerabilities. This information can be leveraged as a reconnaissance step to chain additional attacks — for example, targeting a vulnerable plugin identified through the disclosure. The direct impact is limited to confidentiality (no integrity or availability impact), but the exposed plugin inventory significantly lowers the barrier for follow-on exploitation (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-8676 as of the available data. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid subscriber-level WordPress account on the target site (Wordfence, ENISA EUVD).

1. Obtain a low-privileged account: Register or obtain a subscriber-level (or higher) WordPress account on the target site running B Slider plugin version ≤ 2.0.0.
2. Authenticate: Log in to the WordPress site with the subscriber account to obtain a valid session cookie or nonce.
3. Invoke the vulnerable function: Send an authenticated HTTP request that triggers the get_active_plugins function exposed by the plugin's admin menu handler (e.g., via a crafted AJAX or admin-ajax.php request referencing the plugin's registered action).
4. Collect plugin inventory: Parse the response to enumerate all active plugins, their versions, and names installed on the WordPress instance.
5. Pivot to further attacks: Cross-reference the discovered plugins against known vulnerability databases (e.g., WPScan, Wordfence) to identify additional attack vectors on the target site (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST or GET requests to wp-admin/admin-ajax.php or similar endpoints with actions associated with the B Slider plugin from subscriber-level user accounts.
• Logs: Repeated or scripted requests to plugin-related endpoints from a single low-privileged user account in a short time window, suggesting automated enumeration.
• Network: Unusual outbound data transfers or API calls from a subscriber account that would not normally interact with admin-level plugin functions.

The vulnerability was addressed in a patch committed to the plugin's repository (changeset 3343487). WordPress site administrators should update the B Slider – Gutenberg Slider Block for WP plugin to a version above 2.0.0 as soon as a patched release is available via the WordPress plugin repository. As an interim workaround, administrators can restrict subscriber-level user registration or remove untrusted subscriber accounts. Additionally, using a WordPress security plugin (e.g., Wordfence) to monitor and block suspicious authenticated requests to admin functions is advisable (Wordfence, WordPress Trac Changeset).