CVE-2025-12539

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12539", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T21:09:49.456Z", "datePublished": "2025-11-11T11:03:44.429Z", "dateUpdated": "2026-04-08T16:44:28.205Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:28.205Z"}, "affected": [{"vendor": "leopardhost", "product": "TNC Toolbox: Web Performance", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the \"Tnc_Wp_Toolbox_Settings::save_settings\" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment."}], "title": "TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaa5a5c-c11f-40d0-be69-c3ec8029a819?source=cve"}, {"url": "https://github.com/The-Network-Crew/TNC-Toolbox-for-WordPress/commit/31bb3040b22c84e2d6dfd3210fe0ad045ff4ddf6"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-922 Insecure Storage of Sensitive Information", "cweId": "CWE-922", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "timeline": [{"time": "2025-10-22T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-04T03:26:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-10T22:27:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T15:25:19.153388Z", "id": "CVE-2025-12539", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:29:41.682Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-14T15:25:19.153388Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:25:19.779Z"}}], "cna": {"title": "TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover", "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 10, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "leopardhost", "product": "TNC Toolbox: Web Performance", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-22T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-04T03:26:52.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-10T22:27:47.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaa5a5c-c11f-40d0-be69-c3ec8029a819?source=cve"}, {"url": "https://github.com/The-Network-Crew/TNC-Toolbox-for-WordPress/commit/31bb3040b22c84e2d6dfd3210fe0ad045ff4ddf6"}], "descriptions": [{"lang": "en", "value": "The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the \"Tnc_Wp_Toolbox_Settings::save_settings\" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-922", "description": "CWE-922 Insecure Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-11T11:03:44.429Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12539", "state": "PUBLISHED", "dateUpdated": "2025-11-14T15:29:41.682Z", "dateReserved": "2025-10-30T21:09:49.456Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T11:03:44.429Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TNC Toolbox: Web Performance", "vendor": "leopardhost", "versions": [{"lessThanOrEqual": "1.4.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the \"Tnc_Wp_Toolbox_Settings::save_settings\" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment."}, {"lang": "es", "value": "El plugin TNC Toolbox: Web Performance para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n sensible en todas las versiones hasta la 1.4.2, inclusive. Esto se debe a que el plugin almacena credenciales de la API de cPanel (nombre de host, nombre de usuario y clave de API) en archivos dentro del directorio wp-content, accesible desde la web, sin protecci\u00f3n adecuada en la funci\u00f3n \u201cTnc_Wp_Toolbox_Settings::save_settings\u201d. Esto hace posible que atacantes no autenticados recuperen estas credenciales y las utilicen para interactuar con la API de cPanel, lo que puede conducir a la carga arbitraria de archivos, ejecuci\u00f3n remota de c\u00f3digo y al compromiso total del entorno de alojamiento."}], "id": "CVE-2025-12539", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12539", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T15:25:19.153388Z", "version": "2.0.3"}}]}, "published": "2025-11-11T11:15:33.180", "references": [{"source": "security@wordfence.com", "url": "https://github.com/The-Network-Crew/TNC-Toolbox-for-WordPress/commit/31bb3040b22c84e2d6dfd3210fe0ad045ff4ddf6"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaa5a5c-c11f-40d0-be69-c3ec8029a819?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-922"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:42:36.343341+00:00", "value": {"mitigation_remediation": ["Update the TNC Toolbox: Web Performance plugin to the latest available version, ensuring that credential files are no longer stored in web\u2011accessible locations.", "If an update is not immediately possible, locate the credential files within the wp-content directory and either delete them or move them outside the web root so that they cannot be accessed via HTTP.", "Configure the web server or .htaccess rules to forbid web access to directories or files that hold sensitive information within wp-content, thereby preventing the unauthenticated download of credential files."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites running the TNC Toolbox: Web Performance plugin version 1.4.2 or earlier are affected. The plugin is distributed by leopardhost under the product name TNC Toolbox: Web Performance. No further version information is available in the CVE data, so any site still on these releases is vulnerable.", "description_and_impact": "The TNC Toolbox: Web Performance plugin for WordPress stores cPanel API credentials in plain text files inside the web\u2011accessible wp-content directory, a flaw that allows attackers to read those files without authentication. With access to the hostname, username, and API key, an adversary can call the cPanel API and perform operations such as arbitrary file uploads, remote code execution, and complete takeover of the hosting account. The weakness is a sensitive information exposure in the settings persistence layer, classified as CWE-922.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 10, indicating critical severity. The EPSS score is reported as less than 1%, meaning the public exploitation probability is low at the time of this assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated read access to files in wp-content, allowing the attacker to retrieve the unprotected credentials. Once those credentials are obtained, exploitation of the cPanel API grants full control over the hosting environment."}}}}, "created": "2025-11-12T12:42:45.831581+00:00", "updated": "2026-04-22T16:45:21.462112+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}