CVE-2025-12134: ZoloBlocks WordPress Auth Bypass Flaw

CVE-2025-12134 Overview

CVE-2025-12134 affects the ZoloBlocks Gutenberg Block Editor plugin for WordPress. The plugin exposes the update_popup_status() function without a capability check. Unauthenticated attackers can send network requests to enable or disable popups on affected sites. The issue impacts all plugin versions up to and including 2.3.11. The weakness is classified as CWE-862 Missing Authorization.

Critical Impact
Unauthenticated remote attackers can modify popup state on any WordPress site running a vulnerable ZoloBlocks version, affecting site integrity and content presentation.

Affected Products

ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns
All versions up to and including 2.3.11
WordPress sites with the plugin installed and active

Discovery Timeline

2025-10-24 - CVE-2025-12134 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12134

Vulnerability Analysis

The ZoloBlocks plugin registers an AJAX or REST endpoint that invokes update_popup_status() to toggle popup visibility. The handler does not verify the caller's WordPress capabilities before processing the request. As a result, any HTTP client can reach the function and change popup state without authentication.

This is a Broken Access Control issue mapped to CWE-862. The attack is network-based, requires no privileges, and needs no user interaction. Impact is limited to integrity of the popup configuration. Confidentiality and availability of the site remain unaffected according to the published vector.

Root Cause

The update_popup_status() function lacks a current_user_can() check and does not validate a valid nonce for state-changing operations. WordPress developer guidance requires capability checks on any handler that modifies persistent settings. The absence of this check exposes the endpoint to anonymous callers.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable endpoint on a target WordPress site. The request supplies parameters that toggle popup status. The server accepts the request and persists the change. No credentials, tokens, or user interaction are needed.

The vulnerability mechanism is documented in the WordPress Changeset Update and the Wordfence Vulnerability Report. See the referenced advisory for the specific parameter format used to invoke the function.

Detection Methods for CVE-2025-12134

Indicators of Compromise

Unexpected changes to popup enabled or disabled state in the ZoloBlocks plugin settings or wp_options table.
Anonymous POST requests targeting ZoloBlocks AJAX actions or REST routes in web server access logs.
Log entries showing admin-ajax.php calls referencing update_popup_status from unauthenticated sessions.

Detection Strategies

Review WordPress access logs for requests to plugin endpoints containing update_popup_status without an authenticated wordpress_logged_in cookie.
Compare current plugin option values against a known-good baseline to identify unauthorized modifications.
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated calls to the ZoloBlocks popup status endpoint.

Monitoring Recommendations

Alert on high-frequency POST requests to admin-ajax.php from single source IP addresses.
Monitor wp_options writes tied to ZoloBlocks keys and correlate with the authenticated user context.
Track plugin version inventory across managed WordPress instances to identify hosts still running 2.3.11 or earlier.

How to Mitigate CVE-2025-12134

Immediate Actions Required

Update the ZoloBlocks plugin to the version released after the WordPress Changeset Update that adds the missing capability check.
Audit plugin settings and popup state to confirm no unauthorized modifications were persisted.
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible.

Patch Information

The vendor addressed the missing capability check in the changeset referenced above. Site administrators should install the fixed release through the WordPress plugin updater. Verify the installed version is later than 2.3.11 after upgrading.

Workarounds

Deactivate and remove the ZoloBlocks plugin until the patched version is installed.
Add a WAF rule that blocks unauthenticated requests carrying the update_popup_status action parameter.
Restrict the plugin's endpoint using server-level access controls until the update is applied.

bash

# Example WAF-style rule blocking unauthenticated popup status changes
# ModSecurity rule outline
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012134,\
   msg:'Block unauthenticated ZoloBlocks update_popup_status'"
  SecRule ARGS:action "@streq update_popup_status" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"