CVE-2025-12886
Published: 28 March 2026
Summary
CVE-2025-12886 is a high-severity SSRF (CWE-918) vulnerability in Laborator (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-12886, published on 2026-03-28, is a Server-Side Request Forgery (SSRF) vulnerability classified under CWE-918 in the Oxygen Theme for WordPress. It affects all versions up to and including 6.0.8 through the laborator_calc_route AJAX action, enabling forged requests from the server to arbitrary locations.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity, no privileges, and no user interaction, as reflected in its CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). Exploitation allows attackers to originate web requests from the web application, potentially querying or modifying data in internal services.
Mitigation details are outlined in advisories including the Oxygen Theme release notes at https://documentation.laborator.co/kb/oxygen/oxygen-release-notes/ and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/8c83f430-8a4d-40fa-890c-387c787a3b55?source=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209108
Vulnerability details
The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating…
more
from the web application and can be used to query and modify information from internal services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing WordPress component directly matches exploitation of internet-facing applications (T1190) to issue server-originating requests against internal/external targets.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of inputs to the laborator_calc_route AJAX action, directly preventing arbitrary server-side requests to internal or external locations.
Mandates timely remediation of the SSRF flaw in Oxygen Theme versions up to 6.0.8 through patching as detailed in release notes and advisories.
Enforces monitoring and control of communications at system boundaries to block unauthorized outbound requests triggered by the vulnerable AJAX handler.