CVE-2025-12189

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12189", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-24T20:00:43.777Z", "datePublished": "2025-12-05T05:31:27.915Z", "dateUpdated": "2026-04-08T17:18:24.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:24.884Z"}, "affected": [{"vendor": "breadbutter", "product": "Bread & Butter: AI-Powered Lead Intelligence", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.11.1374", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb280004-e0ba-44c8-a205-8fec30900d86?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bread-butter/trunk/src/Base/Ajax.php#L411"}, {"url": "https://github.com/d0n601/CVE-2025-12189"}, {"url": "https://ryankozak.com/posts/cve-2025-12189/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3408692/bread-butter/trunk/src/Base/Ajax.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ryan Kozak"}], "timeline": [{"time": "2025-12-04T16:31:43.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"references": [{"url": "https://github.com/d0n601/CVE-2025-12189", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T14:05:51.865787Z", "id": "CVE-2025-12189", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T14:06:06.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12189", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T14:05:51.865787Z"}}}], "references": [{"url": "https://github.com/d0n601/CVE-2025-12189", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T14:05:44.715Z"}}], "cna": {"title": "Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Ryan Kozak"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "breadbutter", "product": "Bread & Butter: AI-Powered Lead Intelligence", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.11.1374"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T16:31:43.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb280004-e0ba-44c8-a205-8fec30900d86?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bread-butter/trunk/src/Base/Ajax.php#L411"}, {"url": "https://github.com/d0n601/CVE-2025-12189"}, {"url": "https://ryankozak.com/posts/cve-2025-12189/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3408692/bread-butter/trunk/src/Base/Ajax.php"}], "descriptions": [{"lang": "en", "value": "The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:24.884Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12189", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:18:24.884Z", "dateReserved": "2025-10-24T20:00:43.777Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T05:31:27.915Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Bread & Butter: AI-Powered Lead Intelligence", "vendor": "breadbutter", "versions": [{"lessThanOrEqual": "7.11.1374", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:breadbutter:bread_\\&_butter:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "630FA8D3-D849-4772-BC9E-8846EDFAA9D8", "versionEndIncluding": "7.11.1374", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 7.10.1321, inclusive. Esto se debe a una validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n uploadImage(). Esto hace posible que atacantes no autenticados suban archivos arbitrarios que hacen posible la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12189", "lastModified": "2026-10-18T15:10:00.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12189", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T14:05:51.865787Z", "version": "2.0.3"}}]}, "published": "2025-12-05T06:16:06.573", "references": [{"source": "security@wordfence.com", "tags": ["Exploit"], "url": "https://github.com/d0n601/CVE-2025-12189"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/bread-butter/trunk/src/Base/Ajax.php#L411"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3408692/bread-butter/trunk/src/Base/Ajax.php"}, {"source": "security@wordfence.com", "tags": ["Exploit"], "url": "https://ryankozak.com/posts/cve-2025-12189/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb280004-e0ba-44c8-a205-8fec30900d86?source=cve"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit"], "url": "https://github.com/d0n601/CVE-2025-12189"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:08:01.945777+00:00", "value": {"mitigation_remediation": ["Apply the latest Bread & Butter plugin update (>=7.11.1375).", "If the plugin is not essential, uninstall or deactivate it.", "Implement a web\u2011application firewall rule to block unauthenticated file uploads to the plugin\u2019s upload endpoint."], "summary": {"action": "Patch Now", "impact": "Remote code execution through unrestricted file upload"}, "threat_synthesis": {"affected_systems": "Bread & Butter AI\u2011Powered Lead Intelligence plugin for WordPress, all versions up to and including 7.11.1374.", "description_and_impact": "This vulnerability originates from an omitted or incorrect nonce check in the uploadImage() routine of the Bread & Butter WordPress plugin. The missing CSRF protection lets an unauthenticated attacker submit a crafted request that uploads any file to the server. If the attacker can trick a site administrator into visiting the forged URL, the uploaded file may be executed as code, enabling full control over the affected system.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate risk level, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. The attack vector relies on CSRF: an attacker must lure an administrator to click a malicious link, after which arbitrary file upload and potential remote code execution become possible. Privilege escalation is not required, but the outcome can be fully deterministic if the admin authorizes the request."}}}}, "created": "2025-12-05T10:51:57.520725+00:00", "updated": "2026-04-21T01:15:20.129025+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}