CVE-2025-12406

The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L244
• https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L248
• https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L293
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e774476d-3696-4489-b028-16c25f8db1ca?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12400The LMB^Box Smileys plugin for WordPress is vulnerable to Cr…6.1
• CVE-2025-12401The Label Plugins plugin for WordPress is vulnerable to Cros…6.1
• CVE-2025-12402The LinkedIn Resume plugin for WordPress is vulnerable to Cr…6.1
• CVE-2025-12403The Associados Amazon Plugin plugin for WordPress is vulnera…6.1
• CVE-2025-12404The Like-it plugin for WordPress is vulnerable to Cross-Site…6.1
• CVE-2025-12405An improper privilege management vulnerability was found in …7.7
• CVE-2025-12407The Events Manager – Calendar, Bookings, Tickets, and more! …4.3
• CVE-2025-12408The Events Manager – Calendar, Bookings, Tickets, and more! …5.3
• CVE-2025-12409A SQL injection vulnerability was discovered in Looker Studi…7.3
• CVE-2025-1241Encrypted values in Fortra's GoAnywhere MFT prior to version…4.9
• CVE-2025-12410The SH Contextual Help plugin for WordPress is vulnerable to…6.1
• CVE-2025-12411The Premmerce Wholesale Pricing for WooCommerce plugin for W…7.1