CVE-2025-8676 is a medium-severity vulnerability affecting the B Slider- Gutenberg Slider Block for WordPress plugin, specifically versions up to and including 2.0.0. The vulnerability is classified under CWE-200, indicating an exposure of sensitive information to unauthorized actors. The root cause lies in the get_active_plugins function, which improperly exposes details about installed plugins. An authenticated attacker with subscriber-level access or higher privileges can exploit this flaw to retrieve sensitive information about the WordPress environment, including the list of installed plugins. This information disclosure does not require user interaction and can be performed remotely over the network. The CVSS 3.1 base score is 4.3, reflecting a low complexity attack vector (network), low attack complexity, and requiring privileges (PR:L) but no user interaction. The vulnerability impacts confidentiality but does not affect integrity or availability. No known exploits are currently reported in the wild, and no patches or fixes have been officially released as of the publication date (August 15, 2025). The exposure of plugin information can aid attackers in crafting targeted attacks, such as identifying vulnerable plugins for further exploitation or fingerprinting the WordPress installation for reconnaissance purposes.

For European organizations using WordPress websites with the B Slider- Gutenberg Slider Block plugin, this vulnerability poses a moderate risk. Exposure of installed plugin information can facilitate targeted attacks by revealing the presence of other vulnerable or outdated plugins, potentially leading to privilege escalation, data breaches, or website defacement if chained with other vulnerabilities. Organizations in sectors with high web presence, such as e-commerce, media, and government, may face increased risk due to the sensitive nature of their online assets. While the vulnerability itself does not directly compromise data integrity or availability, it lowers the barrier for attackers to conduct more sophisticated attacks. The requirement for authenticated access at subscriber level means that attackers must first obtain or create a low-privilege account, which is often feasible on sites allowing user registrations or through credential stuffing attacks. This risk is heightened in environments with weak access controls or insufficient monitoring of user activities.

European organizations should implement the following specific mitigations: 1) Immediately audit WordPress sites for the presence of the B Slider- Gutenberg Slider Block plugin and verify the version in use. 2) Restrict user registration and enforce strong authentication mechanisms to prevent unauthorized account creation or credential abuse. 3) Limit subscriber-level permissions to the minimum necessary and monitor for unusual activity indicative of reconnaissance attempts. 4) Employ web application firewalls (WAFs) with custom rules to detect and block suspicious requests targeting the get_active_plugins function or similar plugin enumeration attempts. 5) Since no official patch is available, consider temporarily disabling or removing the vulnerable plugin until a fix is released. 6) Conduct regular security assessments and vulnerability scans to identify and remediate related weaknesses. 7) Educate site administrators about the risks of information disclosure and the importance of timely updates once patches become available.