{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12074", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T14:12:09.205Z", "datePublished": "2026-02-18T04:35:41.852Z", "dateUpdated": "2026-02-18T12:53:56.485Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-18T04:35:41.852Z"}, "affected": [{"vendor": "postmagthemes", "product": "Context Blog", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "1.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "title": "Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25552fdb-c55b-4390-a614-7c007c5fe7b1?source=cve"}, {"url": "https://themes.svn.wordpress.org/context-blog/1.2.1/inc/ajax/modal-popup.php"}, {"url": "https://wordpress.org/themes/context-blog/"}, {"url": "https://www.postmagthemes.com/downloads/context-blog-free-wordpress-theme/"}, {"url": "https://themes.trac.wordpress.org/changeset/297968/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "jason carle"}], "timeline": [{"time": "2026-02-17T16:33:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T12:26:33.868256Z", "id": "CVE-2025-12074", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:53:56.485Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12074", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T12:26:33.868256Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:26:34.735Z"}}], "cna": {"title": "Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "jason carle"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "postmagthemes", "product": "Context Blog", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-17T16:33:21.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25552fdb-c55b-4390-a614-7c007c5fe7b1?source=cve"}, {"url": "https://themes.svn.wordpress.org/context-blog/1.2.1/inc/ajax/modal-popup.php"}, {"url": "https://wordpress.org/themes/context-blog/"}, {"url": "https://www.postmagthemes.com/downloads/context-blog-free-wordpress-theme/"}, {"url": "https://themes.trac.wordpress.org/changeset/297968/"}], "descriptions": [{"lang": "en", "value": "The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-18T04:35:41.852Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12074", "state": "PUBLISHED", "dateUpdated": "2026-02-18T12:53:56.485Z", "dateReserved": "2025-10-22T14:12:09.205Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T04:35:41.852Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}, {"lang": "es", "value": "El tema Context Blog para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n en todas las versiones hasta e incluyendo la 1.2.5 a trav\u00e9s de 'context_blog_modal_popup' debido a restricciones insuficientes sobre qu\u00e9 publicaciones pueden ser incluidas. Esto hace posible que atacantes no autenticados extraigan datos de publicaciones protegidas con contrase\u00f1a, privadas o en borrador a las que no deber\u00edan tener acceso."}], "id": "CVE-2025-12074", "lastModified": "2026-02-18T17:51:53.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-02-18T05:16:16.950", "references": [{"source": "security@wordfence.com", "url": "https://themes.svn.wordpress.org/context-blog/1.2.1/inc/ajax/modal-popup.php"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/changeset/297968/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/themes/context-blog/"}, {"source": "security@wordfence.com", "url": "https://www.postmagthemes.com/downloads/context-blog-free-wordpress-theme/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25552fdb-c55b-4390-a614-7c007c5fe7b1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"created": "2026-02-18T10:32:59.489858+00:00", "updated": "2026-02-18T10:32:59.489975+00:00", "vendors": ["postmagthemes", "postmagthemes$PRODUCT$context_blog", "wordpress", "wordpress$PRODUCT$wordpress"]}