Cross-Site Request Forgery in Bread & Butter Plugin for WordPress

CVE-2025-12189

What is CVE-2025-12189?

The Bread & Butter plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability due to insufficient nonce validation in its uploadImage() function. An unauthenticated attacker could exploit this weakness to upload arbitrary files, potentially leading to remote code execution. If an administrator is tricked into clicking a malicious link, the attacker can execute harmful actions on the site. It is crucial for users of the plugin to apply security measures and updates to mitigate this risk.

References