CVE-2025-12002: 
WordPress vulnerability analysis and mitigation

CVE-2025-12002 is an unauthenticated arbitrary file read vulnerability in the Feeds for YouTube Pro plugin for WordPress, affecting all versions up to and including 2.6.0. The flaw is exploitable via the sby_check_wp_submit AJAX action and requires two specific plugin settings to be active: 'Save Featured Images' must be enabled and 'Disable WP Posts' must be disabled. It was disclosed on January 16–17, 2026, with Wordfence as the CNA. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-22 (Path Traversal) — insufficient sanitization of user-supplied input that is subsequently passed to a file operation without proper restriction to a safe directory. Specifically, the vulnerable code resides in AdminAjaxService.php (lines 25, 339, 383) and sby-functions.php (lines 1038, 1047) within the plugin's source tree. An unauthenticated attacker can craft a malicious AJAX request to the sby_check_wp_submit action with a path-traversal payload, causing the server to read and return the contents of arbitrary files outside the intended directory. Exploitation is conditional on the plugin's 'Save Featured Images' setting being enabled and 'Disable WP Posts' being disabled (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem, including sensitive files such as WordPress wp-config.php (containing database credentials and secret keys), /etc/passwd, application configuration files, or private keys. This results in a high confidentiality impact with no integrity or availability impact. Exposed credentials could enable further attacks such as database access, privilege escalation, or full site compromise (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.00199 (~0.2%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific plugin configuration conditions (high attack complexity), which limits the attack surface (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Feeds for YouTube Pro plugin (version ≤ 2.6.0) using tools like WPScan, Shodan, or by checking /wp-content/plugins/feeds-for-youtube/ for version indicators.
2. Verify configuration preconditions: Confirm that the target site has 'Save Featured Images' enabled and 'Disable WP Posts' disabled in the plugin settings — these are required for the vulnerable code path to be reachable.
3. Craft malicious AJAX request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with action=sby_check_wp_submit and a path-traversal payload in the relevant parameter (e.g., ../../../../../../etc/passwd or ../../wp-config.php).
4. Read arbitrary file contents: The server processes the unsanitized input in a file read operation and returns the contents of the targeted file in the response, exposing sensitive data such as database credentials from wp-config.php (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated POST requests to /wp-admin/admin-ajax.php with action=sby_check_wp_submit and parameters containing path-traversal sequences (e.g., ../, %2e%2e%2f, ..%2f).
• Logs: WordPress access logs showing repeated AJAX requests to admin-ajax.php from a single IP with traversal-pattern strings in POST body data; HTTP 200 responses to these requests from unauthenticated sessions.
• File System: No direct file system artifacts are expected from read-only exploitation, but subsequent attacks leveraging exposed credentials may result in new admin accounts, modified files, or installed backdoors.

Users should update the Feeds for YouTube Pro plugin to a version above 2.6.0 as soon as a patched release is available from Smash Balloon / Awesome Motive. As an interim workaround, administrators can disable the 'Save Featured Images' setting or enable 'Disable WP Posts' in the plugin configuration to break the vulnerable code path. Additionally, restricting unauthenticated access to wp-admin/admin-ajax.php via WAF rules or server-level controls can reduce exposure (Wordfence, Smash Balloon).

Wordfence disclosed the vulnerability and served as the CNA, publishing details in their threat intelligence database. Red Hat also tracked the CVE in their security advisory system. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Wordfence, Red Hat CVE).