Server-Side Request Forgery Vulnerability in B Carousel Block Plugin for WordPress

CVE-2025-12388

What is CVE-2025-12388?

The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is susceptible to a Server-Side Request Forgery attack due to insufficient validation of user input for URLs. Authenticated users with subscriber-level access or higher can exploit this vulnerability, allowing them to initiate web requests to potentially harmful external locations. This exposes sensitive internal services to unauthorized queries and modifications, posing a significant risk to the overall security of the affected WordPress sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References