CVE-2025-12630: 
WordPress vulnerability analysis and mitigation

CVE-2025-12630 is an arbitrary option disclosure vulnerability in the Upload.am File Hosting VPN WordPress plugin affecting versions before 1.0.1. Due to a missing capability check on its AJAX request handler, authenticated users with contributor-level access or higher can retrieve arbitrary WordPress site options, including sensitive configuration values. The vulnerability was publicly disclosed on 2025-09-29 and assigned CVE-2025-12630, with a CVSS v3.1 base score of 4.9 (Medium) (WPScan, Red Hat CVE).

The root cause is a missing authorization check (CWE-862) on the plugin's AJAX action handler (upload_am_get_option), which falls under OWASP Top 10 A5: Broken Access Control. An authenticated contributor can obtain a valid nonce from the post editor page source (var uploadAmSettings) and then send a crafted POST request to /wp-admin/admin-ajax.php specifying any option_name parameter — for example, mailserver_login — to retrieve the corresponding site option value. Exploitation requires a valid WordPress account with at least contributor privileges and a valid nonce, but no further elevated permissions (WPScan).

Successful exploitation allows authenticated low-privileged users to read arbitrary WordPress site options, which may include sensitive configuration data such as mail server credentials, API keys, or other stored secrets. This is a confidentiality-only impact with no integrity or availability consequences, but exposed credentials could facilitate further attacks such as account takeover or lateral movement within the hosting environment (WPScan, Red Hat CVE).

A proof-of-concept (PoC) is publicly documented by the original researcher, Beatriz Fresno Naumova, and included in the WPScan advisory. Exploitation requires an authenticated contributor-level account and a valid nonce, limiting opportunistic mass exploitation. The EPSS score is approximately 0.026% (very low), and there is no evidence of in-the-wild exploitation or inclusion in the CISA KEV catalog (WPScan, Red Hat CVE).

1. Obtain contributor access: Log in to the target WordPress site with a contributor-level (or higher) account.
2. Retrieve the nonce: Navigate to the new post editor at /wp-admin/post-new.php and view the page source. Search for var uploadAmSettings to locate the nonce value embedded by the plugin.
3. Craft the AJAX request: Send a POST request to /wp-admin/admin-ajax.php with the following parameters:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: example.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_xxx=<session_cookie>
   
   action=upload_am_get_option&option_name=mailserver_login&nonce=VALID_NONCE_HERE

4. Extract sensitive data: The server responds with the value of the requested WordPress option (e.g., mailserver_login). Repeat with different option_name values to enumerate additional sensitive site options (WPScan).

• Network: Repeated POST requests to /wp-admin/admin-ajax.php with action=upload_am_get_option and varying option_name values from a single authenticated session.
• Logs: WordPress access logs showing multiple AJAX requests to admin-ajax.php with the upload_am_get_option action parameter, particularly targeting sensitive option names such as mailserver_login, mailserver_pass, or API key options.
• Logs: Requests originating from contributor-level accounts that do not normally interact with admin AJAX endpoints.

Update the Upload.am File Hosting VPN WordPress plugin to version 1.0.1 or later, which introduces the missing capability check on the AJAX handler. As an interim workaround, site administrators can restrict contributor-level account creation or disable the plugin until patching is feasible. There are no known configuration-only mitigations that fully address the missing authorization check (WPScan).