CVE-2025-12189: Breadbutter Bread & Butter CSRF Vulnerability

CVE-2025-12189 Overview

CVE-2025-12189 is a Cross-Site Request Forgery (CSRF) vulnerability in the Bread & Butter WordPress plugin, affecting all versions up to and including 7.11.1374. The flaw resides in the uploadImage() function, which lacks proper nonce validation. Unauthenticated attackers can craft malicious requests that, when triggered by an authenticated administrator, upload arbitrary files to the server. This file upload primitive enables remote code execution on affected WordPress sites. The vulnerability is tracked under [CWE-352] and requires user interaction such as clicking a malicious link.

Critical Impact

An attacker who tricks a site administrator into visiting a malicious page can upload arbitrary files via the unprotected AJAX endpoint, leading to remote code execution under the web server context.

Affected Products

• Bread & Butter plugin for WordPress – all versions through 7.11.1374
• WordPress sites running the vulnerable bread-butter plugin
• Sites where administrators interact with attacker-controlled web content

Discovery Timeline

• 2025-12-05 - CVE-2025-12189 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-12189

Vulnerability Analysis

The Bread & Butter plugin exposes an AJAX endpoint backed by the uploadImage() function defined in src/Base/Ajax.php. This handler accepts file upload data but fails to validate a WordPress nonce token before processing the request. WordPress nonces are the platform's primary defense against CSRF, and their absence allows any cross-origin request from an authenticated administrator's browser to succeed.

The attack chain combines two weaknesses. First, the missing nonce check permits forged requests. Second, the upload handler does not adequately restrict file types or destinations, allowing attackers to place executable PHP content within the WordPress directory structure. Once uploaded, the attacker can request the file directly to trigger server-side code execution.

Root Cause

The root cause is missing or incorrect nonce validation on the uploadImage() AJAX action [CWE-352]. WordPress provides check_ajax_referer() and wp_verify_nonce() helpers specifically to prevent this class of issue, but the affected handler omits these checks before processing uploaded data.

Attack Vector

Exploitation requires an attacker to host a malicious page containing an auto-submitting form or JavaScript fetch request targeting the admin-ajax.php endpoint of the victim site. The attacker delivers the link to an administrator through phishing, social media, or a compromised site. When the administrator visits the page while authenticated to WordPress, the browser submits the forged multipart upload request with valid session cookies. The plugin processes the upload, writes the attacker's PHP payload to disk, and the attacker then accesses the uploaded file URL to execute arbitrary commands.

For technical analysis and proof-of-concept details, refer to the Ryan Kozak CVE Analysis and the GitHub PoC Repository. The vendor fix is visible in the WordPress Plugin Changeset.

Detection Methods for CVE-2025-12189

Indicators of Compromise

• Unexpected PHP, .phtml, or other executable files appearing within the Bread & Butter plugin upload directories or wp-content/uploads/
• POST requests to admin-ajax.php invoking the plugin's image upload action with Referer headers pointing to external or unknown domains
• Web server access logs showing direct requests to newly created files in upload directories shortly after an administrator session
• New administrator accounts, modified theme or plugin files, or unscheduled cron jobs created after the upload event

Detection Strategies

• Monitor WordPress AJAX traffic for requests to the uploadImage action that lack a valid _wpnonce parameter or originate from off-site referers
• Deploy file integrity monitoring on wp-content/uploads/ and plugin directories to alert on creation of files with executable extensions
• Correlate administrator browser activity with subsequent file writes and outbound connections from the web server process
• Review web application firewall logs for multipart POST requests containing PHP shell signatures or suspicious file extensions

Monitoring Recommendations

• Enable verbose access logging on the WordPress instance and forward logs to a centralized analytics platform for retention and search
• Alert on any execution of PHP files from within upload directories, which should never serve dynamic content
• Track plugin version inventory across managed WordPress sites to identify hosts still running vulnerable Bread & Butter releases

How to Mitigate CVE-2025-12189

Immediate Actions Required

• Update the Bread & Butter plugin to a version newer than 7.11.1374 that includes the nonce validation fix referenced in the vendor changeset
• Audit wp-content/uploads/ and the plugin directory for unexpected files, particularly any with PHP or scripting extensions
• Rotate administrator credentials and review user accounts for unauthorized additions following any suspected exploitation
• Restrict administrator browsing behavior and enforce session isolation to limit CSRF exposure

Patch Information

The vendor addressed the issue by adding nonce validation to the uploadImage() handler. The fix is documented in the WordPress Plugin Changeset 3408692. Site operators should apply the latest plugin release available through the WordPress plugin directory. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

• Deactivate and remove the Bread & Butter plugin until the patched version can be installed
• Configure the web server to deny execution of PHP files within wp-content/uploads/ using directory-level handler restrictions
• Deploy a web application firewall rule blocking POST requests to the vulnerable AJAX action that lack a valid nonce parameter
• Require administrators to use a dedicated browser profile for WordPress management to reduce cross-site request exposure

# Apache: deny PHP execution in WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (server block)
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}