CVE-2025-12560: Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.6.0 via the getFullContent() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12560?
CVE-2025-12560 is a critical vulnerability that allows Server-Side Request Forgery, potentially compromising the WordPress site.
How do I fix CVE-2025-12560?
To fix CVE-2025-12560, update the Blog2Social plugin to version 8.6.1 or later.
Who is affected by CVE-2025-12560?
CVE-2025-12560 affects all versions of the Blog2Social plugin up to and including version 8.6.0.
What type of attack does CVE-2025-12560 allow?
CVE-2025-12560 allows authenticated attackers with Subscriber-level access to exploit the vulnerability through Server-Side Request Forgery.
What function in Blog2Social is vulnerable in CVE-2025-12560?
The getFullContent() function in Blog2Social is the specific function vulnerable to CVE-2025-12560.