Server-Side Request Forgery Vulnerability in B Carousel Block Plugin for WordPress

CVE-2025-12388

What is CVE-2025-12388?

The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is susceptible to a Server-Side Request Forgery attack due to insufficient validation of user input for URLs. Authenticated users with subscriber-level access or higher can exploit this vulnerability, allowing them to initiate web requests to potentially harmful external locations. This exposes sensitive internal services to unauthorized queries and modifications, posing a significant risk to the overall security of the affected WordPress sites.

References