PT-2026-3336 · WordPress · Feeds For Youtube Pro

Liontree · CVE-2025-12002 · Published 2026-01-17 · Updated 2026-01-17

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Feeds for YouTube Pro plugin for WordPress versions prior to 2.6.0

Description The Feeds for YouTube Pro plugin for WordPress is susceptible to unauthorized access to files. This is caused by inadequate validation of data provided by users, which is then used in file operations. An attacker who successfully exploits this issue can read the contents of arbitrary files on the server, potentially exposing sensitive information. This is possible when the 'Save Featured Images' setting is enabled and 'Disable WP Posts' is disabled. The issue affects unauthenticated users.

Recommendations Update the Feeds for YouTube Pro plugin to version 2.6.0 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12002

Affected Products

Feeds For Youtube Pro

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12002 · Security Note
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/Services/AdminAjaxService.php#L339 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e9f31ec5-c376-45b1-9ffe-35c80b89b60d?source=cve · Note
• https://twitter.com/CVEnew/status/2012490354176512419 · Twitter Post
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/Services/AdminAjaxService.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/sby-functions.php#L1038 · Note
• https://smashballoon.com/youtube-feed · Note
• https://twitter.com/VulmonFeeds/status/2012381607512916096 · Twitter Post
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/sby-functions.php#L1047 · Note
• https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/inc/Services/AdminAjaxService.php#L383 · Note