PT-2026-3336 · WordPress · Feeds For Youtube Pro

Liontree · Publicado 2026-01-17 · Atualizado 2026-01-17 · CVE-2025-12002

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Feeds for YouTube Pro plugin for WordPress versions prior to 2.6.0

Description The Feeds for YouTube Pro plugin for WordPress is susceptible to unauthorized access to files. This is caused by inadequate validation of data provided by users, which is then used in file operations. An attacker who successfully exploits this issue can read the contents of arbitrary files on the server, potentially exposing sensitive information. This is possible when the 'Save Featured Images' setting is enabled and 'Disable WP Posts' is disabled. The issue affects unauthenticated users.

Recommendations Update the Feeds for YouTube Pro plugin to version 2.6.0 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-12002

Produtos afetados

Feeds For Youtube Pro

Referências · 10

• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/Services/AdminAjaxService.php#L339 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/e9f31ec5-c376-45b1-9ffe-35c80b89b60d?source=cve · Nota
• https://twitter.com/CVEnew/status/2012490354176512419 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/Services/AdminAjaxService.php#L25 · Nota
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/sby-functions.php#L1038 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12002 · Nota de Segurança
• https://smashballoon.com/youtube-feed · Nota
• https://twitter.com/VulmonFeeds/status/2012381607512916096 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/sby-functions.php#L1047 · Nota
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/Services/AdminAjaxService.php#L383 · Nota