CVE Intelligence
Analysis AI-assisted

CVE-2026-25429: Nexa Blocks WordPress Plugin Object Injection (CWE-502)

Nexa Blocks, a WordPress plugin by wpdive, contains a deserialization of untrusted data weakness (CWE-502) that allows object injection. The CNA, Patchstack, rates it Critical with a CVSS 3.1 base score of 9.8, and the record describes affected versions up to and including 1.1.1. No fixed version and no confirmed exploitation appear in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25429 is a deserialization of untrusted data weakness (CWE-502) in the Nexa Blocks plugin by wpdive for WordPress, identified by the slug nexa-blocks. According to the record, it allows object injection. The CNA is Patchstack, and the record describes the issue as affecting versions up to and including 1.1.1.

Impact

The CNA scores the issue at 9.8 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector indicates network reachability, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. The specific consequences of object injection in this plugin are not described in the available sources.

Affected products and versions

  • Product: Nexa Blocks (nexa-blocks), vendor wpdive, WordPress plugin.
  • Affected range per the description: from n/a through 1.1.1 inclusive.
  • The record contains no structured affected or fixed version entries.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00564 with a percentile of 0.45338.

Remediation and mitigation

  • Identify which WordPress sites run Nexa Blocks and at which version.
  • Check the Patchstack advisory and the vendor for a release newer than 1.1.1. The sources reviewed do not name a fixed version.
  • If no fixed version is confirmed, consider deactivating and removing the plugin, or restricting exposure until a fix is verified.
  • Keep WordPress core, themes and other plugins updated, and limit access to administrative functions.

Detection guidance

  • Inventory plugin versions across WordPress installations and flag any at 1.1.1 or earlier.
  • Review web server and application logs for unusual requests directed at the plugin, and monitor for unexpected changes to site files or content.
  • Treat unexpected PHP errors or object-related warnings linked to the plugin as signals for investigation.

Limitations of the available information

The source record has no title, no structured affected or fixed product entries, and no technical description beyond the summary sentence. Whether exploitation is practical, what the exact impact is, and which fixed version exists could not be confirmed from the sources provided. The EPSS date in the record is 2026-10-13, so that value should be interpreted with caution.

Frequently asked questions

What is CVE-2026-25429?

It is a deserialization of untrusted data weakness (CWE-502) in the Nexa Blocks WordPress plugin by wpdive, which the record says allows object injection. The CNA Patchstack reports it affects versions up to and including 1.1.1.

Is this vulnerability being exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it seriously given the critical score.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.