CVE-2025-2568

MEDIUM

Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-2568 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_toggle_switch_callback' function in versions 1.0.4 to 1.2.1. This makes it possible for unauthenticated attackers to read plugin options and update any option with a key name ending in '_value'.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 8, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce

Browse themehunk / Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce

Default status: unaffected

CVE List1.0.4 to ≤ 1.2.1affected

Proofs of concept

1

Repository PoCs

GitHubshinigami-777/PoC_CVE-2025-2568Repository PoCby shinigami-7770Not analyzed4 files

2.6 MiB

GitHub
PoC details

Docker lab environments

1
GitHub

vuln-wordpress/docker-compose.yml

shinigami-777/PoC_CVE-2025-2568Created Vuln labCVE-2025-2568Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a WordPress site with MySQL, designed to demonstrate CVE-2025-2568 in the Vayu Blocks plugin.

vuln-wordpress/docker-compose.yml:1-27README.md:1-35

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2025-2568, and the Compose file sets up a vulnerable WordPress instance with the plugin mounted for exploitation.

README.md:1README.md:3-5vuln-wordpress/docker-compose.yml:1-27
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

MySQL database server

MySQL 5.7 service storing WordPress data, with credentials set via environment variables.

vuln-wordpress/docker-compose.yml:2-10

wordpress

WordPress application server

WordPress 6.8.3 service exposed on host port 8080, with a bind-mounted wp-content directory containing the vulnerable Vayu Blocks plugin.

vuln-wordpress/docker-compose.yml:12-22

vayu-blocks plugin

Vulnerable WordPress plugin

The Vayu Blocks plugin version 1.2.0, provided as a zip file to be extracted into wp-content/plugins, contains the vulnerable functions.

README.md:3-5README.md:10-13
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-2568

Supported by supplied evidence

The README describes the vulnerability as unauthorized access and modification due to missing capability checks in the specified functions, and the provided exploit steps match this description.

README.md:3-5README.md:18-25
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:7-9
  • The Vayu Blocks plugin zip must be extracted into the wp-content/plugins directory.README.md:10-13

Evidence-described exercise path

  1. Clone the repository and start the Docker Compose environment.README.md:7-9
  2. Extract the Vayu Blocks plugin zip into the mounted wp-content/plugins directory.README.md:10-13
  3. Send a GET request to the vulnerable endpoint to read plugin options.README.md:16-18
  4. Send a POST request to the vulnerable endpoint to modify option values.README.md:19-23
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained lab targeting its own WordPress instance. No evidence of host escape, external connections, persistence, or destructive behavior beyond the intended vulnerability demonstration.

vuln-wordpress/docker-compose.yml:1-27README.md:1-35
Review boundaries

What the analysis did not establish

  • The vayu-blocks.1.2.0.zip file is uninspected binary; its exact contents and behavior are unknown.
  • The exploit video referenced in the README is not included in the evidence packet.
  • No Dockerfiles or other configuration files are present to verify the full build process.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

References

4