CVE-2025-62026 MEDIUM

CVE-2025-62026: WordPress Blockspare plugin <= 3.2.13.2 - Sensitive Data Exposure vulnerability

Vendor Blockspare

Product Blockspare

Weakness CWE-201

Published October 22, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects Blockspare: from n/a through <= 3.2.13.2.

Explanation of Vulnerability in Simple Terms

02Summary

Blockspare versions up to 3.2.13.2 expose sensitive information to authenticated users. An attacker with low-level account access can read data they should not have permission to view. The vulnerability requires valid login credentials and affects confidentiality only. Update to version 4.2.0 or later to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive data they lack authorization to access.

Potential impact on your site

04Site Impact

User data confidentiality is at risk if accounts are compromised or shared among untrusted staff.

Conditions required to exploit

05Prerequisites

Valid login account with low-level privileges; network access to the application.

Key dates

06Disclosure timeline

October 22, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-62026 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html

Related vulnerabilities