CVE-2025-28872 is a medium severity (CVSS 5.3) missing authorization flaw in the Block Spam By Math Reloaded WordPress plugin, versions up to and including 2.2.4. Some functionality is not properly limited by access controls. Patchstack lists no official patch, so consider replacing the plugin.
What's affected
The record says Block Spam By Math Reloaded from n/a through 2.2.4 is affected. The Patchstack page we fetched shows 2.2.4 as the vulnerable version and states that no official patch is available, with a low priority rating and no impactful threat.
That low rating matches the score: the vector shows only a low availability impact and no loss of confidentiality or integrity.
Severity in the record: medium, CVSS 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. Weakness classes: CWE-862 (Missing authorization).
How to check if you're exposed
If you manage WordPress with the command line tool, list the plugin and its version:
wp plugin list --name=block-spam-by-math-reloaded
Otherwise open the Plugins screen in the dashboard and look for Block Spam By Math Reloaded. Any version up to 2.2.4 is in the range.
If you run many sites, check each one, including staging copies and old sites you rarely open. A hosting control panel or a site management tool can list plugin versions in bulk.
What to do now
- Check the plugin page and Patchstack for a fixed release, and update if one appears.
- If no patch exists, weigh whether you need the plugin. Comment spam can be handled by other maintained tools.
- If you decide to remove it, deactivate and delete it, then check that your comment forms still work.
- Keep WordPress core, themes and other plugins current, and remove plugins you no longer use.
- Monitor the site for unusual requests to the plugin's endpoints in your access logs.
- Add the plugin to your watch list so you hear if the author publishes an update.
Why it matters
CWE-862 is missing authorization. A function that should check whether the caller is allowed to use it does not, so anyone who can reach it can use it. In WordPress this typically shows up as an action or endpoint that checks nothing, or only checks that the user is logged in.
The impact here is small. The vector scores only a low effect on availability, which fits a spam filter whose settings or state could be disturbed. The reason to act is less the score than the lack of a patch: an unmaintained plugin tends to collect more issues over time, and removing it costs little.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
Is there a fixed version of Block Spam By Math Reloaded?
Patchstack says no official patch is available for versions up to 2.2.4. Check the plugin page for news.
How serious is CVE-2025-28872?
Medium, at CVSS 5.3, with low availability impact only. Patchstack rates it low priority.
Sources
Last reviewed: 19 October 2026.
