Sensitive Information Exposure in TNC Toolbox Plugin for WordPress

CVE-2025-12539

What is CVE-2025-12539?

The TNC Toolbox: Web Performance plugin for WordPress is at risk of exposing sensitive information due to the insecure storage of cPanel API credentials within the web-accessible wp-content directory. This vulnerability arises from the inadequate protection in the save_settings function of the plugin. Unauthenticated attackers can access these credentials, potentially allowing them to execute arbitrary file uploads, engage in remote code execution, and completely compromise the hosting environment.

References