CVE-2025-12129

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12129", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-23T18:45:51.310Z", "datePublished": "2026-01-17T07:27:37.085Z", "dateUpdated": "2026-04-08T16:41:09.676Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:09.676Z"}, "affected": [{"vendor": "cubewp1211", "product": "CubeWP Framework", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.27", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CubeWP \u2013 All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "title": "CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2006dc4c-ec1a-45ab-94a3-1f86d80e70ca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422640/cubewp-framework/trunk/cube/classes/class-cubewp-rest-api.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-23T19:00:59.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-16T19:16:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T19:09:27.709016Z", "id": "CVE-2025-12129", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:23:34.063Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T19:09:27.709016Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:09:51.745Z"}}], "cna": {"title": "CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "cubewp1211", "product": "CubeWP Framework", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.27"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-23T19:00:59.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-16T19:16:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2006dc4c-ec1a-45ab-94a3-1f86d80e70ca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422640/cubewp-framework/trunk/cube/classes/class-cubewp-rest-api.php"}], "descriptions": [{"lang": "en", "value": "The CubeWP \u2013 All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:09.676Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12129", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:09.676Z", "dateReserved": "2025-10-23T18:45:51.310Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-17T07:27:37.085Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CubeWP Framework", "vendor": "cubewp1211", "versions": [{"lessThanOrEqual": "1.1.27", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CubeWP \u2013 All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}, {"lang": "es", "value": "El plugin CubeWP \u2013 All-in-One Dynamic Content Framework para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n en todas las versiones hasta la 1.1.27, inclusive, a trav\u00e9s de los puntos finales de la API REST /cubewp-posts/v1/query-new y /cubewp-posts/v1/query debido a restricciones insuficientes sobre qu\u00e9 publicaciones pueden incluirse. Esto permite a atacantes no autenticados extraer datos de publicaciones protegidas con contrase\u00f1a, privadas o en borrador a las que no deber\u00edan tener acceso."}], "id": "CVE-2025-12129", "lastModified": "2026-06-17T08:31:46.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12129", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T19:09:27.709016Z", "version": "2.0.3"}}]}, "published": "2026-01-17T08:15:50.850", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3422640/cubewp-framework/trunk/cube/classes/class-cubewp-rest-api.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2006dc4c-ec1a-45ab-94a3-1f86d80e70ca?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:09:20.069539+00:00", "value": {"mitigation_remediation": ["Upgrade CubeWP Framework to a version newer than 1.1.27", "Disable or remove the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query endpoints if they are unnecessary", "Ensure WordPress default visibility restrictions are enforced so only authorized users can read private or draft posts"], "summary": {"action": "Update Plugin", "impact": "Information Exposure"}, "threat_synthesis": {"affected_systems": "The defect applies to all installations running CubeWP Framework versions 1.1.27 or older. Any WordPress site with the plugin enabled and containing protected or unpublished posts is susceptible, regardless of the site\u2019s overall content visibility settings.", "description_and_impact": "CubeWP \u2013 All-in-One Dynamic Content Framework, a WordPress plugin, exposes sensitive post data through two REST API endpoints: /cubewp-posts/v1/query-new and /cubewp-posts/v1/query. The flaw stems from insufficient access controls, allowing an attacker to read the content of password\u2011protected, private, or draft posts that should be hidden. This vulnerability is classified under CWE\u2011200 Information Exposure and results in confidentiality loss without affecting system integrity or availability.", "risk_and_exploitability": "The CVSS score of 5.3 denotes medium severity. The EPSS score of less than 1% indicates a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network\u2011based, as the vulnerable REST API can be accessed publicly without credentials. An unauthenticated attacker with network access to the site can invoke the exposed endpoints and extract hidden data, leading to confidentiality compromise. No active exploitation is documented, but the flaw remains a valid concern for sites handling sensitive content."}}}}, "created": "2026-01-19T09:19:24.466077+00:00", "updated": "2026-04-22T20:15:20.532831+00:00", "vendors": ["cubewp", "cubewp$PRODUCT$cubewp", "wordpress", "wordpress$PRODUCT$wordpress"]}