CVE-2025-12129: CubeWP Information Disclosure Flaw

CVE-2025-12129 Overview

CVE-2025-12129 is an Information Exposure vulnerability affecting the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress. The vulnerability exists in all versions up to, and including, 1.1.27 and allows unauthenticated attackers to extract sensitive post data through improperly secured REST API endpoints.

Critical Impact

Unauthenticated attackers can extract data from password protected, private, or draft posts that should not be publicly accessible, potentially exposing sensitive business information, unpublished content, or confidential data.

Affected Products

• CubeWP – All-in-One Dynamic Content Framework plugin for WordPress versions up to and including 1.1.27
• WordPress installations using affected CubeWP plugin versions
• Websites with private, password-protected, or draft content managed through CubeWP

Discovery Timeline

• 2026-01-17 - CVE CVE-2025-12129 published to NVD
• 2026-01-17 - Last updated in NVD database

Technical Details for CVE-2025-12129

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Information Exposure), which occurs when the application exposes sensitive information to unauthorized parties. The CubeWP plugin's REST API implementation fails to properly validate whether the requesting user has permission to access certain post types, specifically those marked as private, password-protected, or in draft status.

The vulnerable endpoints /cubewp-posts/v1/query-new and /cubewp-posts/v1/query do not implement sufficient access control checks when returning post data. This allows any unauthenticated user to craft API requests that return content that should be restricted.

Root Cause

The root cause of this vulnerability lies in insufficient restrictions within the REST API endpoint handlers. The CubeWP plugin's class-cubewp-rest-api.php file did not properly filter query results based on post visibility status (publish, private, draft, password-protected). The API endpoints were designed to return post data but failed to verify that the requesting user had the appropriate permissions to view posts with restricted access levels.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests to the vulnerable REST API endpoints.

The exploitation process involves:

1. Identifying a WordPress site running a vulnerable version of the CubeWP plugin
2. Sending API requests to /wp-json/cubewp-posts/v1/query-new or /wp-json/cubewp-posts/v1/query endpoints
3. Manipulating query parameters to include post types and statuses that should be restricted
4. Receiving sensitive post content including private, draft, or password-protected posts in the API response

For technical details regarding the vulnerability mechanism and the applied fix, refer to the WordPress Plugin Changeset.

Detection Methods for CVE-2025-12129

Indicators of Compromise

• Unusual or high-frequency requests to /wp-json/cubewp-posts/v1/query-new endpoint
• Requests to /wp-json/cubewp-posts/v1/query from unfamiliar IP addresses
• API queries attempting to access post statuses such as private, draft, or pending
• Access logs showing unauthenticated requests returning normally restricted content

Detection Strategies

• Monitor web server access logs for requests targeting CubeWP REST API endpoints
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious REST API query patterns
• Review WordPress audit logs for unusual API access patterns, particularly from unauthenticated sources
• Deploy intrusion detection rules that flag attempts to access draft or private post statuses via API

Monitoring Recommendations

• Enable detailed logging for all REST API requests on WordPress installations
• Set up alerts for spikes in traffic to CubeWP-specific endpoints
• Regularly audit which posts have been accessed through API endpoints
• Implement rate limiting on REST API endpoints to slow down automated enumeration attempts

How to Mitigate CVE-2025-12129

Immediate Actions Required

• Update the CubeWP plugin to a version newer than 1.1.27 immediately
• Review web server logs for any signs of exploitation targeting the vulnerable endpoints
• Audit any sensitive content that may have been exposed through the vulnerability
• Consider temporarily disabling the CubeWP plugin if an update cannot be applied immediately

Patch Information

The vulnerability has been addressed in plugin updates. The fix can be reviewed in the WordPress Plugin Changeset which modifies the class-cubewp-rest-api.php file to implement proper access controls on REST API query responses.

Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement server-level access restrictions to block unauthenticated requests to /wp-json/cubewp-posts/v1/ endpoints
• Use a Web Application Firewall (WAF) to filter requests attempting to query private or draft posts
• Disable the REST API functionality via security plugins if CubeWP REST features are not required
• Apply IP-based restrictions to limit API access to trusted networks only

# Apache .htaccess workaround to restrict CubeWP REST API access
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/cubewp-posts/v1/ [NC]
RewriteCond %{HTTP:Authorization} ^$
RewriteRule ^ - [F,L]
</IfModule>