CVE-2025-12406: XSS in Project Honey Pot Spam Trap

The primary impact of CVE-2025-12406 is the potential for an attacker to execute arbitrary JavaScript code within the context of a WordPress administrator's session. This could lead to account takeover, data theft (including sensitive user information and administrative credentials), and defacement of the website. Successful exploitation hinges on the attacker's ability to trick a site administrator into clicking a malicious link or performing an action that triggers the vulnerable printAdminPage() function. The attack vector is CSRF-based, meaning the attacker doesn't need to authenticate but needs to forge a request that appears legitimate to the server.

1. Reserved2025-10-28
2. Published2025-11-18
3. Modified2026-04-08
4. EPSS updated2026-03-23

The immediate mitigation for CVE-2025-12406 is to upgrade the Project Honey Pot Spam Trap plugin to a version containing the security fix. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests to the printAdminPage() function that lack proper nonce validation. Carefully review any recent changes to the plugin's configuration or code to identify potential vulnerabilities. After upgrading, verify the fix by attempting to trigger the vulnerable function with a forged request and confirming that the action is blocked.