CVE-2025-47485: Cozy Blocks Authorization Bypass Flaw

CVE-2025-47485 Overview

CVE-2025-47485 is a Missing Authorization vulnerability [CWE-862] affecting the CozyThemes Cozy Blocks (cozy-addons) WordPress plugin. The flaw impacts all versions up to and including 2.1.22. The plugin exposes functionality protected by incorrectly configured access control security levels, allowing unauthenticated network-based requests to reach restricted operations. The vulnerability affects confidentiality without requiring authentication or user interaction. Attackers can query resources that should be gated behind proper authorization checks. Because the plugin is a WordPress add-on, any site running an unpatched version is directly exposed to the public internet.

Critical Impact
Unauthenticated attackers can reach protected plugin functionality over the network due to missing authorization checks, leading to limited information exposure on affected WordPress sites.

Affected Products

CozyThemes Cozy Blocks (cozy-addons) WordPress plugin
All versions from initial release through 2.1.22
WordPress sites with the plugin installed and active

Discovery Timeline

2025-05-07 - CVE-2025-47485 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47485

Vulnerability Analysis

The vulnerability stems from broken access control in the Cozy Blocks plugin. The plugin registers endpoints or actions that fail to enforce capability checks before executing their logic. WordPress plugins typically gate sensitive functionality using current_user_can() checks or nonce validation. Cozy Blocks omits or misconfigures these checks on at least one code path. Unauthenticated remote requests can therefore trigger functionality intended for authorized users only. The scope of impact is limited to confidentiality, meaning attackers can read data that should have been protected but cannot modify state or crash the application.

Root Cause

The root cause is a missing authorization check [CWE-862] on one or more plugin handlers. The developer registered a handler exposed via the WordPress REST API or admin-ajax.php without validating the caller's role or capability. Access control security levels were configured incorrectly, treating restricted routes as public. This class of flaw is common in WordPress plugins that rely on obscurity rather than explicit permission callbacks.

Attack Vector

Exploitation occurs remotely over HTTP or HTTPS. An attacker sends a crafted request to the vulnerable endpoint exposed by cozy-addons. No credentials or user interaction are required. The response returns data the plugin should have protected. See the Patchstack Cozy Blocks Vulnerability advisory for further technical detail. No public proof-of-concept code has been verified for this CVE.

Detection Methods for CVE-2025-47485

Indicators of Compromise

Unauthenticated HTTP requests to /wp-json/ routes registered by the cozy-addons plugin
Repeated admin-ajax.php POST requests referencing Cozy Blocks action names without a valid session cookie
Unusual response sizes returned to unauthenticated clients from plugin endpoints

Detection Strategies

Audit WordPress access logs for requests to plugin routes containing cozy or cozy-addons originating from unauthenticated IP addresses
Compare the installed cozy-addons plugin version against 2.1.22 using WordPress inventory tooling or wp plugin list
Deploy web application firewall rules that flag anomalous request patterns to Cozy Blocks REST endpoints

Monitoring Recommendations

Forward WordPress and web server access logs to a centralized log store for correlation and retention
Alert on spikes of unauthenticated requests to /wp-json/cozy-addons/* or matching AJAX actions
Track plugin version drift across managed WordPress fleets to identify hosts running vulnerable builds

How to Mitigate CVE-2025-47485

Immediate Actions Required

Update the Cozy Blocks (cozy-addons) plugin to a version later than 2.1.22 once the vendor publishes a fixed release
Inventory all WordPress sites to identify installations running vulnerable versions
Restrict access to /wp-json/ and admin-ajax.php from untrusted networks where operationally feasible

Patch Information

Refer to the Patchstack Cozy Blocks Vulnerability advisory for current patch availability and remediation guidance from CozyThemes. Sites should apply the fixed release as soon as it becomes available.

Workarounds

Deactivate and remove the cozy-addons plugin if it is not required for site functionality
Deploy a web application firewall rule that blocks unauthenticated requests to Cozy Blocks REST and AJAX endpoints
Place the WordPress admin surface behind an authenticated reverse proxy or IP allowlist while a patch is pending

bash

# Example: block unauthenticated access to cozy-addons REST routes via nginx
location ~ ^/wp-json/cozy-addons/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}