Project Honey Pot Spam Trap <= 1.0.1 - クロスサイトリクエストフォージェリによる格納型クロスサイトスクリプティング

The primary impact of CVE-2025-12406 is the potential for an attacker to execute arbitrary JavaScript code within the context of a WordPress administrator's session. This could lead to account takeover, data theft (including sensitive user information and administrative credentials), and defacement of the website. Successful exploitation hinges on the attacker's ability to trick a site administrator into clicking a malicious link or performing an action that triggers the vulnerable printAdminPage() function. The attack vector is CSRF-based, meaning the attacker doesn't need to authenticate but needs to forge a request that appears legitimate to the server.

WordPress websites utilizing the Project Honey Pot Spam Trap plugin, particularly those with administrative accounts that are frequently targeted by phishing or social engineering attacks, are at increased risk. Shared hosting environments where multiple websites share the same server resources may also be vulnerable if one site is compromised.

• wordpress / composer / npm:

grep -r 'printAdminPage()' /var/www/html/wp-content/plugins/project-honey-pot-spam-trap/

• generic web:

curl -I https://example.com/wp-admin/admin.php?page=project-honey-pot-spam-trap-admin | grep -i 'set-cookie'

• wordpress / composer / npm:

wp plugin list --status=inactive | grep 'project-honey-pot-spam-trap'

1. 2025-11-18Disclosure

   disclosure

1. 予約済み2025-10-28
2. 公開日2025-11-18
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The immediate mitigation for CVE-2025-12406 is to upgrade the Project Honey Pot Spam Trap plugin to a version containing the security fix. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests to the printAdminPage() function that lack proper nonce validation. Carefully review any recent changes to the plugin's configuration or code to identify potential vulnerabilities. After upgrading, verify the fix by attempting to trigger the vulnerable function with a forged request and confirming that the action is blocked.