CVE-2025-12406

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12406", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T14:53:21.080Z", "datePublished": "2025-11-18T08:27:37.486Z", "dateUpdated": "2026-04-08T17:30:24.057Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:24.057Z"}, "affected": [{"vendor": "awensley", "product": "Project Honey Pot Spam Trap", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e774476d-3696-4489-b028-16c25f8db1ca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L244"}, {"url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L248"}, {"url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L293"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-11-17T20:09:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T21:07:31.835002Z", "id": "CVE-2025-12406", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:07:39.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12406", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T21:07:31.835002Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:07:35.529Z"}}], "cna": {"title": "Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "awensley", "product": "Project Honey Pot Spam Trap", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T20:09:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e774476d-3696-4489-b028-16c25f8db1ca?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L244"}, {"url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L248"}, {"url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L293"}], "descriptions": [{"lang": "en", "value": "The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:24.057Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12406", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:30:24.057Z", "dateReserved": "2025-10-28T14:53:21.080Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T08:27:37.486Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Project Honey Pot Spam Trap", "vendor": "awensley", "versions": [{"lessThanOrEqual": "1.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Project Honey Pot Spam Trap para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 1.0.1, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la funci\u00f3n printAdminPage(). Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12406", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12406", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T21:07:31.835002Z", "version": "2.0.3"}}]}, "published": "2025-11-18T09:15:48.317", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L244"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L248"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L293"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e774476d-3696-4489-b028-16c25f8db1ca?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:33:02.954241+00:00", "value": {"mitigation_remediation": ["Apply a patch by updating the Project Honey Pot Spam Trap plugin to a version newer than 1.0.1 where the nonce validation has been restored.", "Ensure that only trusted administrators have the capability to edit plugin settings, and block or limit direct access to the printAdminPage() function for users without that capability.", "Configure a CSRF protection layer or web application firewall that validates the presence of a valid wordfence or nonce token on all admin POST requests, preventing forged requests from being processed."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting via a CSRF\u2011enabled admin setting update"}, "threat_synthesis": {"affected_systems": "WordPress users running the Project Honey Pot Spam Trap plugin version 1.0.1 or earlier are affected. All installations of this plugin up to and including 1.0.1 have the missing nonce check in printAdminPage().", "description_and_impact": "The Project Honey Pot Spam Trap WordPress plugin fails to validate a nonce in its printAdminPage() function. Because the verification is missing or incorrect, an attacker can send a forged request that updates the plugin\u2019s settings and injects malicious script code. The resulting stored XSS is executed whenever an administrator views the injected content, allowing the attacker to execute arbitrary client\u2011side code in the context of the site. This can lead to session hijacking, defacement, or other injection\u2011based attacks, compromising the integrity and confidentiality of the site\u2019s administrative interface.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% signifies low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker must trick a site administrator into executing a forged request\u2014typically by clicking a malicious link\u2014since the vulnerability is unauthenticated. Once the forged request is sent, the plugin will accept the malicious script and store it, leading to an immediate XSS risk."}}}}, "created": "2025-11-19T10:47:59.586606+00:00", "updated": "2026-04-21T01:45:24.436953+00:00", "vendors": ["awensley", "awensley$PRODUCT$project_honey_pot_spam_trap", "wordpress", "wordpress$PRODUCT$wordpress"]}