Cross-Site Request Forgery in Bread & Butter Plugin for WordPress

CVE-2025-12189

What is CVE-2025-12189?

The Bread & Butter plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability due to insufficient nonce validation in its uploadImage() function. An unauthenticated attacker could exploit this weakness to upload arbitrary files, potentially leading to remote code execution. If an administrator is tricked into clicking a malicious link, the attacker can execute harmful actions on the site. It is crucial for users of the plugin to apply security measures and updates to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References