← Back

CVE-2025-12189

nvd nist
Published: Dec 5, 2025Modified: Apr 8, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected (1)

Breadbutter
1 product
Bread & Butter
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Bread & Butter
Up to 7.11.1374

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (6)

Source: security@wordfence.com
Exploit
Source: security@wordfence.com
Product
Source: security@wordfence.com
Source: security@wordfence.com
Exploit
Source: security@wordfence.com
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit

Timeline

No history available yet.