CVE-2025-9376 describes an authorization bypass vulnerability in the sminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin. The issue arises from an insufficient capability check in the 'stopbadbots_check_wordpress_logged_in_cookie' function, allowing unauthenticated users to circumvent the plugin's blocklists and rate limiting features. This vulnerability affects all versions up to and including 11.58. The CVSS 3.1 score of 6.5 reflects a network attack vector with low complexity and no privileges required, resulting in limited confidentiality impact and low availability impact.

An unauthenticated attacker can bypass the plugin's protections designed to block malicious bots and enforce rate limits. This may lead to unauthorized access to data protected by the plugin's mechanisms and potential degradation of service due to evasion of rate limits. However, the impact is limited to confidentiality and availability with no integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor the vendor's communications for updates. No specific temporary mitigations are documented in the provided data.