PT-2026-28271 · WordPress · Oxygen Theme For Wordpress

Published 2026-03-28 · Updated 2026-03-28 · CVE-2025-12886

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oxygen Theme for WordPress versions up to and including 6.0.8

Description The Oxygen Theme for WordPress is susceptible to Server-Side Request Forgery (SSRF) through the laborator calc route AJAX action. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, potentially enabling them to query and modify information from internal services. The issue is triggered via the route path parameter.

Recommendations Update Oxygen Theme for WordPress to a version later than 6.0.8.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-12886

Affected Products

Oxygen Theme For Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12886 · Security Note
• https://twitter.com/CVEnew/status/2037719335758897264 · Twitter Post
• https://twitter.com/CVEarity/status/2037781117089284363 · Twitter Post
• https://twitter.com/cyberbivash/status/2037752513147908412 · Twitter Post
• https://documentation.laborator.co/kb/oxygen/oxygen-release-notes · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8c83f430-8a4d-40fa-890c-387c787a3b55?source=cve · Note
• https://twitter.com/cyberbivash/status/2037789334791704978 · Twitter Post