How to fix CVE-2025-12630?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Is PHP affected by CVE-2025-12630?

Organizations using Upload.am WordPress should be aware of moderate risk from CVE-2025-12630 rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

CVE-2025-12630

EUVD-2025-200267 MEDIUM

2025-12-02 [email protected]

Information Disclosure WordPress PHP

4.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

patch_available

Apr 16, 2026 - 05:29 EUVD

1.0.1

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200267

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 16:15 nvd

MEDIUM 4.9

DescriptionNVD

The Upload.am WordPress plugin before 1.0.1 is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX request handler, allowing users such as contributor to view site options.

AnalysisAI

A security vulnerability in Upload.am WordPress (CVSS 4.9). Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type not specified by vendor. Affects Upload.am WordPress.

RemediationAI

Monitor vendor channels for patch availability.

CVE-2025-12630 vulnerability details – vuln.today

Back

CVE-2025-12630

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code