CVE-2025-54739: Nexter Blocks Auth Bypass Vulnerability

CVE-2025-54739 Overview

CVE-2025-54739 is a missing authorization vulnerability in the POSIMYTH Nexter Blocks plugin (the-plus-addons-for-block-editor) for WordPress. The flaw affects all versions up to and including 4.5.4. Attackers can exploit incorrectly configured access control security levels to reach functionality that should be restricted. The issue is classified under CWE-862: Missing Authorization and can be triggered remotely without authentication or user interaction.

Critical Impact
Unauthenticated network-based attackers can access plugin functionality that lacks proper authorization checks, exposing limited confidential information from affected WordPress sites.

Affected Products

POSIMYTH Nexter Blocks (the-plus-addons-for-block-editor) WordPress plugin
All versions from n/a through 4.5.4
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-08-14 - CVE-2025-54739 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54739

Vulnerability Analysis

The Nexter Blocks plugin exposes functionality without enforcing proper authorization checks on requests. Under [CWE-862], the application performs sensitive actions without verifying that the caller has permission to execute them. Because the flaw is reachable over the network with no privileges and no user interaction, any remote actor can send crafted requests to the affected endpoints.

The EPSS score is 0.238% at the 14.9 percentile, indicating low observed exploitation activity at the time of publication. However, WordPress plugin flaws in broadly distributed block editor add-ons are frequently weaponized once details reach public vulnerability databases.

Root Cause

The root cause is missing or incorrectly configured capability and nonce checks on plugin actions. Access control decisions rely on assumptions rather than explicit verification. The plugin exposes handlers that should be limited to administrators or editors but are reachable by lower-privileged or unauthenticated users. This is a common pattern in WordPress plugins that omit current_user_can() verification before executing privileged operations.

Attack Vector

An attacker sends HTTP requests directly to the plugin's exposed endpoints, such as AJAX actions or REST routes registered by Nexter Blocks. Because authorization is not enforced server-side, the endpoint processes the request and returns or modifies data. The confidentiality impact is limited, while integrity and availability remain unaffected according to the CVSS breakdown. See the Patchstack WordPress Vulnerability Report for endpoint-specific technical details.

Detection Methods for CVE-2025-54739

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php with action parameters registered by Nexter Blocks
Requests to WordPress REST routes under /wp-json/ referencing nexter or tpae namespaces from unauthenticated sessions
Unexpected data exfiltration patterns in web server logs sourced from a single IP targeting plugin endpoints
Presence of the vulnerable plugin at version 4.5.4 or earlier in wp-content/plugins/the-plus-addons-for-block-editor/

Detection Strategies

Inventory all WordPress installations and flag any running Nexter Blocks at or below version 4.5.4
Deploy web application firewall (WAF) rules that alert on unauthenticated access to plugin-specific AJAX and REST endpoints
Correlate access log entries against expected authenticated session cookies to identify anonymous calls to privileged routes

Monitoring Recommendations

Ingest WordPress access logs and PHP error logs into a centralized SIEM for anomaly analysis
Monitor for spikes in admin-ajax.php traffic without valid _wpnonce values
Alert on outbound responses returning larger-than-expected payloads from plugin endpoints, which may indicate data disclosure

How to Mitigate CVE-2025-54739

Immediate Actions Required

Upgrade Nexter Blocks to a version above 4.5.4 as soon as a patched release is available from POSIMYTH
If no patched version is deployed, disable the plugin until an update is applied
Audit WordPress user roles and remove unnecessary privileged accounts to reduce blast radius
Review web server logs for the past 90 days to identify anonymous requests to plugin endpoints

Patch Information

Refer to the Patchstack advisory for Nexter Blocks for the current patched version and vendor guidance. Verify the fix by confirming the installed plugin version in the WordPress admin dashboard under Plugins.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and /wp-json/ endpoints using WAF or reverse proxy rules that require authentication for plugin-specific actions
Apply IP allowlisting to WordPress administrative paths where feasible
Use the WordPress remove_action() API to disable specific vulnerable AJAX hooks in a mu-plugin until the official patch is applied

bash

# Verify installed Nexter Blocks version via WP-CLI
wp plugin get the-plus-addons-for-block-editor --field=version

# Deactivate the plugin until a patched release is applied
wp plugin deactivate the-plus-addons-for-block-editor