CVE-2025-12002

The Feeds for YouTube Pro plugin for WordPress, up to version 2.6.0, contains an arbitrary file read vulnerability in the sby_check_wp_submit AJAX action. The root cause is insufficient sanitization of user-supplied data, which is then used in a file operation. file operation. This allows an attacker to specify arbitrary file paths and read their contents from the server.

Exploitation requires that the 'Save Featured Images' setting is enabled and 'Disable WP Posts' is disabled. The vulnerability is accessible to unauthenticated attackers via the AJAX endpoint, meaning no authentication is needed to trigger the file read. The attacker can supply a crafted request to read any file on the server that the web server user has access to.

The impact is the exposure of sensitive information contained in arbitrary files, such as configuration files, database credentials, or other secrets. This could lead to further compromise of the WordPress site or underlying server. The vulnerability only affects the Pro version of the plugin, as noted in the description.

As of the publication date, the vulnerability is unpatched in versions up to 2.6.0. Users are advised to disable the 'Save Featured Images' setting or enable 'Disable WP Posts' as a workaround, or to apply any available update from the vendor. The plugin is developed by Smash Balloon [1].