Spice Themes Spice Blocks Missing Authorization Vulnerability Allowing Broken Access Control

A broken access control vulnerability has been identified in the Spice Blocks WordPress plugin, affecting versions through 2.0.7.2. This vulnerability arises from missing authorization checks, which can be exploited to manipulate access control security levels incorrectly.

Impact

Exploitation of this vulnerability could allow an unprivileged user to perform actions that require higher privileges, potentially leading to unauthorized changes or access within the WordPress site.

Remediation

Users of the Spice Blocks WordPress plugin are advised to update to version 2.0.7.2 or later. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate the vulnerability until an official update is available.