What is the CVSS score of CVE-2025-12886?

CVE-2025-12886 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-12886?

CVE-2025-12886 is a critical Server-Side Request Forgery vulnerability in Oxygen Theme for WordPress up to version 6.0.8 that allows unauthenticated attackers to make arbitrary HTTP requests from…

How to fix or mitigate CVE-2025-12886?

Within 24 hours: Immediately disable or remove Oxygen Theme from all WordPress installations; if removal is not feasible, apply Web Application Firewall (WAF) rules to block requests to the vulnerable laborator_calc_route AJAX action. Within 7 days: Upgrade to Oxygen Theme version 6.0.9 or later once released by the vendor, or migrate to an alternative WordPress theme. Within 30 days: Conduct a security audit of internal services and cloud environments (AWS/Azure) for signs of unauthorized access or metadata exfiltration; review web server logs for suspicious AJAX requests to laborator_calc_route.

WordPress CVE-2025-12886

EUVD-2025-209108 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-28 Wordfence

GHSA-x7f7-7836-w8h5

WordPress SSRF

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 28, 2026 - 03:30 euvd

EUVD-2025-209108

Analysis Generated

Mar 28, 2026 - 03:30 vuln.today

CVE Published

Mar 28, 2026 - 02:26 nvd

HIGH 7.2

DescriptionCVE.org

The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AnalysisAI

Server-Side Request Forgery (SSRF) in Oxygen Theme for WordPress versions up to 6.0.8 allows unauthenticated remote attackers to make arbitrary HTTP requests from the web server via the vulnerable laborator_calc_route AJAX action. This vulnerability is confirmed exploitable without authentication (CVSS PR:N) and enables attackers to query or modify internal services behind firewalls, exfiltrate cloud metadata (AWS/Azure credentials), or scan internal networks. No public exploit identified at time of analysis, though the unauthenticated attack vector and low complexity (AC:L) suggest straightforward exploitation.

Technical ContextAI

This vulnerability affects the Oxygen Theme (cpe:2.3:a:laborator:oxygen_-_woocommerce_wordpress_theme), a commercial WooCommerce-focused WordPress theme developed by Laborator. The flaw resides in the laborator_calc_route AJAX action handler, which fails to properly validate or restrict the destination of server-initiated HTTP requests. SSRF vulnerabilities (CWE-918) occur when an application accepts user-controlled URLs without adequate validation, allowing attackers to abuse the server as a proxy to access resources that should be protected by network segmentation or firewall rules. WordPress AJAX actions registered without proper capability checks or nonce validation are accessible to unauthenticated users via admin-ajax.php endpoints. The CVSS scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable WordPress installation itself, such as internal services accessible from the web server's network position.

RemediationAI

Site administrators should immediately upgrade to Oxygen Theme version 6.0.9 or later, which addresses this SSRF vulnerability according to the vendor's release notes at https://documentation.laborator.co/kb/oxygen/oxygen-release-notes/. For premium theme updates, log into your ThemeForest account or Laborator customer portal, download the latest version, and install via WordPress admin panel (Appearance > Themes > Add New > Upload Theme) or via FTP by replacing the theme directory. Before updating, create a full site backup including database and theme files. If immediate patching is not feasible, implement temporary network-level controls by restricting outbound connections from the web server to only necessary external services, blocking access to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254). Web Application Firewall (WAF) rules blocking requests to admin-ajax.php with action parameter 'laborator_calc_route' can provide defense-in-depth but should not replace vendor patching. Detailed technical analysis is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/8c83f430-8a4d-40fa-890c-387c787a3b55?source=cve.