CVE-2025-62026

MediumCVSS 4.3

Published: 22/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The Blockspare plugin (versions up to 3.2.13.2) contains an insertion of sensitive information into sent data vulnerability. This may allow retrieval of embedded sensitive data.

Risk Assessment

Sensitive information could leak to unauthorized parties, potentially compromising data privacy or security. The organization may face legal and reputational consequences.

Recommendation

Update the Blockspare plugin to a version higher than 3.2.13.2. Review configuration and check what data is being sent.

Other vulnerabilities in Blockspare

CVE-2026-1242Medium
The BlockSpare plugin for WordPress in versions up to and including 4.2.6 is vulnerable to authorization bypass due to incorrect logic in the permission callback, using an AND (&&) operator instead of an OR (||) operator. Authenticated attackers with Subscriber-level access and above can bypass authorization checks and create arbitrary posts.

Original NVD description (English source)

Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects Blockspare: from n/a through <= 3.2.13.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS