The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Public exploits 1
- d0n601/CVE-2025-12189 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Change history 1
- First seenCVSS 8.8 · breadbutterNVD modified 2026-10-18 15:10
Affected (CPE criteria) 1
cpe:2.3:a:breadbutter:bread_\&_butter:*:*:*:*:*:wordpress:*:*
References 6
- https://github.com/d0n601/CVE-2025-12189 Exploit
- https://plugins.trac.wordpress.org/browser/bread-butter/trunk/src/Base/Ajax.php#L411 Product
- https://plugins.trac.wordpress.org/changeset/3408692/bread-butter/trunk/src/Base/Ajax.php
- https://ryankozak.com/posts/cve-2025-12189/ Exploit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bb280004-e0ba-44c8-a205-8fec30900d86?source=cve Third Party Advisory
- https://github.com/d0n601/CVE-2025-12189 Exploit