Platform
wordpress
Component
block-logic
Fixed in
1.0.9
CVE-2025-2303 is a Remote Code Execution (RCE) vulnerability affecting the Block Logic – Full Gutenberg Block Display Control plugin for WordPress. This vulnerability allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server. The vulnerability impacts versions 1.0.0 through 1.0.8, and a fix is available in version 2.0.0.
Successful exploitation of CVE-2025-2303 allows an attacker to gain complete control over the WordPress server. Given the plugin's functionality, an attacker could modify website content, install malicious plugins, steal sensitive data (user credentials, database information), and potentially pivot to other systems on the network. The impact is particularly severe because the vulnerability requires only Contributor-level access, a relatively low privilege level within WordPress, making it easier for attackers to exploit. This vulnerability shares similarities with other code execution flaws in WordPress plugins where user input is not properly sanitized before being used in code execution functions.
CVE-2025-2303 was publicly disclosed on 2025-03-22. The exploitability of this vulnerability is considered medium due to the requirement for authenticated access. Public proof-of-concept (PoC) code is likely to emerge given the ease of exploitation and the plugin's popularity. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns targeting this vulnerability.
Exploit Status
EPSS
1.29% (80% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-2303 is to immediately upgrade the Block Logic – Full Gutenberg Block Display Control plugin to version 2.0.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the plugin's settings or disabling the plugin entirely. While not a complete solution, a Web Application Firewall (WAF) configured to block requests containing suspicious input to the blocklogiccheck_logic function might offer some protection. After upgrading, verify the fix by attempting to trigger the vulnerable function with malicious input and confirming that it is properly sanitized and does not result in code execution.
Update to version 2.0.0, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-2303 is a Remote Code Execution vulnerability in the Block Logic – Full Gutenberg Block Display Control WordPress plugin, allowing authenticated attackers to execute code on the server.
You are affected if you are using the Block Logic – Full Gutenberg Block Display Control plugin versions 1.0.0 through 1.0.8.
Upgrade the Block Logic – Full Gutenberg Block Display Control plugin to version 2.0.0 or later to remediate the vulnerability.
While no active exploitation has been confirmed, the vulnerability is considered exploitable and public PoCs are likely to emerge, increasing the risk of exploitation.
Refer to the official Block Logic plugin documentation and WordPress security announcements for the latest advisory regarding CVE-2025-2303.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.