Today’s Topics:
- Critical Vulnerability in Firefox Mirrors Chrome’s Exploited Zero-Day
- Critical Vulnerability in Kubio AI Page Builder Puts WordPress Sites at Risk
- How can Netizen help?
Critical Vulnerability in Firefox Mirrors Chrome’s Exploited Zero-Day
Mozilla has released security updates for its Firefox browser on Windows to patch a critical vulnerability, CVE-2025-2857. This flaw, which could allow attackers to escape the browser’s sandbox, was discovered shortly after Google addressed a similar vulnerability (CVE-2025-2783) in Chrome that had been actively exploited as a zero-day.
Mozilla described the issue as an “incorrect handle” in the browser’s inter-process communication (IPC) code, which could enable a compromised child process to gain higher privileges by manipulating the parent process. This would allow attackers to bypass Firefox’s security sandbox, potentially leading to system compromise.
The vulnerability affects both Firefox and Firefox Extended Support Release (ESR) versions. Mozilla has addressed the issue in:
- Firefox 136.0.4
- Firefox ESR 115.21.1
- Firefox ESR 128.8.1
The Tor Project has also released a security update for Tor Browser (version 14.0.8) to mitigate the same flaw for Windows users.
The disclosure comes in the wake of Google’s recent fix for CVE-2025-2783 in Chrome, which was actively exploited in targeted attacks against media outlets, educational institutions, and government organizations in Russia.
Kaspersky, which discovered the attacks in mid-March 2025, reported that victims were infected after clicking on a malicious link in phishing emails. Attackers used a specially crafted exploit chain that leveraged an unknown second vulnerability in Chrome to achieve remote code execution.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-2783 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the necessary patches by April 17, 2025.
Security Operations Center (SOC) teams should treat CVE-2025-2857 as a high-priority risk and take the following steps to ensure protection:
- Update Browsers Immediately: Ensure all instances of Firefox, Firefox ESR, and Tor Browser are updated to the latest patched versions.
- Monitor for Exploitation Attempts: Track any unusual activity related to browser processes, particularly unexpected privilege escalations.
- Review Enterprise Browsing Policies: Enforce browser security settings, such as disabling unnecessary browser extensions and restricting execution of untrusted scripts.
- Educate Users on Phishing Risks: Given the similarities to Chrome’s zero-day exploit, emphasize awareness training on phishing emails and suspicious links.
While there is no evidence that CVE-2025-2857 has been exploited in the wild, its similarity to a recent active zero-day in Chrome makes it a significant security concern. Organizations should patch immediately to prevent potential future attacks.
Critical Vulnerability in Kubio AI Page Builder Puts WordPress Sites at Risk
A severe security vulnerability has been discovered in the Kubio AI Page Builder plugin for WordPress, exposing over 90,000 websites to potential attacks. Tracked as CVE-2025-2294, this flaw allows unauthenticated attackers to exploit a Local File Inclusion (LFI) vulnerability, which can lead to unauthorized file access and code execution.
Kubio is a widely used WordPress website builder that enhances the block editor with additional features and styling options. Its ease of use and powerful customization capabilities have made it popular among website owners who want to build sites without coding knowledge.
Security researcher mikemyers identified the vulnerability in the kubio_hybrid_theme_load_template function. This function fails to properly validate file paths, allowing attackers to include arbitrary files from the server. This oversight opens the door for several dangerous exploits, including:
- Bypassing access controls: Attackers can access restricted files and directories.
- Stealing sensitive data: Private server information and user data can be exposed.
- Achieving code execution: If attackers can upload malicious files (such as disguised images), they can execute arbitrary PHP code, leading to full site compromise.
The vulnerability has been given a critical CVSS score of 9.8, reflecting its potential for widespread exploitation. It affects all versions up to and including 2.5.1.
The issue has been patched in version 2.5.2 of the Kubio AI Page Builder plugin. All users are strongly urged to update immediately to prevent exploitation.
Security teams monitoring WordPress environments should take the following actions:
- Ensure Immediate Patch Deployment: Verify that all instances of Kubio AI Page Builder have been updated to version 2.5.2 or later.
- Monitor for Suspicious File Access: Look for unexpected file inclusion attempts, especially those referencing sensitive directories such as
/etc/passwdorwp-config.php. - Restrict File Upload Permissions: Limit which files can be uploaded and execute server-side validation to prevent unauthorized PHP execution.
- Conduct Regular Security Audits: Scan WordPress installations for outdated plugins and potential misconfigurations that could be exploited.
With a vulnerability of this magnitude, unpatched sites could become easy targets for attackers looking to compromise WordPress websites. Updating immediately and monitoring for potential exploitation attempts should be a top priority.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
