Overview
CVE-2025-12670 identifies a Stored Cross-Site Scripting (XSS) vulnerability affecting the wp-twitpic WordPress plugin. This vulnerability resides in versions 1.0 and earlier. It allows authenticated attackers with Contributor-level access or higher to inject malicious JavaScript code into pages through the plugin’s shortcode functionality. When a user visits a page containing the injected script, the script executes, potentially leading to account compromise, data theft, or other malicious activities.
Technical Details
The wp-twitpic plugin utilizes a shortcode, [twitpic], to embed images from Twitpic (although Twitpic is no longer active, the plugin continues to function and process the shortcode). The vulnerability stems from the plugin’s failure to properly sanitize user-supplied input within the shortcode attributes and its inadequate output escaping. Specifically, multiple parameters associated with the [twitpic] shortcode are susceptible to injection.
The problematic code can be found within the plugin’s PHP file (e.g., wp-twitpic.php at line 42), where shortcode attributes are processed without sufficient security measures.
An attacker can craft a malicious [twitpic] shortcode with a payload embedded within one of the attributes. For instance:
[twitpic image="<img src=x onerror=alert('XSS')>"]CVSS Analysis
The vulnerability has been assigned a CVSS score of 6.4, indicating a MEDIUM severity. This score reflects the following factors:
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L) (Contributor access is sufficient)
- User Interaction (UI): Required (R)
- Scope (S): Changed (C)
- Confidentiality Impact (C): Low (L)
- Integrity Impact (I): Low (L)
- Availability Impact (A): Low (L)
The score is driven by the fact that the attack requires user interaction and impacts confidentiality, integrity, and availability to a limited extent.
Possible Impact
A successful exploitation of this vulnerability could lead to:
- Account Compromise: An attacker could steal a user’s session cookie, allowing them to hijack the user’s account.
- Data Theft: Sensitive information displayed on the affected page could be exfiltrated.
- Malware Distribution: The injected script could redirect users to malicious websites or trigger the download of malware.
- Website Defacement: The injected script could modify the content and appearance of the affected page.
Mitigation/Patch Steps
- Immediate Deactivation: The most immediate action is to deactivate and remove the wp-twitpic plugin from your WordPress installation. Since Twitpic is no longer active, the plugin’s functionality is obsolete.
- Code Review (If Necessary): If you absolutely require the plugin’s functionality, carefully review the plugin’s code for similar vulnerabilities or consider finding an alternative plugin with similar functionality.
- WordPress Security Best Practices: Always adhere to WordPress security best practices, including using strong passwords, keeping WordPress core and plugins up-to-date, and limiting user privileges.
Important Note: As of the current date, there is no official patch available for this vulnerability. The recommended course of action is to remove the plugin.
References
wp-twitpic.php (Plugin Code)
wp-twitpic Plugin Page on WordPress.org
Wordfence Threat Intelligence Report
