CVE-2025-12585

MEDIUM

MxChat - AI Chatbot for WordPress <2.5.5 - Info Disclosure

Title source: llm

Description

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access conversation data.

References (6)

https://github.com/d0n601/CVE-2025-12585

View Exploit ZIP pw:eip

https://ryankozak.com/posts/cve-2025-12585

[Various Sources] https://ryankozak.com/posts/cve-2025-12585/

[Product] https://plugins.trac.wordpress.org/browser/mxchat-basic/trunk/includes/class-mxchat-integrator.php#L107

[Product] https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3406402%40mxchat-basic&new=3406402%40mxchat-basic&sfp_email=&sfph_mail=

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf1a90d-6157-40e7-aed8-4d18bc22432d?source=cve

Scores

CVSS v3 5.3

EPSS 0.0008

EPSS Percentile 23.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

mxchat/MxChat – AI Chatbot & Content Generation for WordPress < 2.5.5

mxchat/MxChat – AI Chatbot for WordPress < 2.5.5

Published Dec 03, 2025

Tracked Since Feb 18, 2026