CVE-2025-12512

🗓️ 13 Dec 2025 03:20:25Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 12 Views🌐 WEB

Contributors can exfiltrate user metadata via exposed REST routes in GenerateBlocks up to 2.1.2.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12512	13 Dec 202507:14	–	circl
CNNVD	WordPress plugin GenerateBlocks 信息泄露漏洞	13 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-12512 GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata	13 Dec 202503:20	–	cvelist
EUVD	EUVD-2025-203187	13 Dec 202518:30	–	euvd
NVD	CVE-2025-12512	13 Dec 202516:16	–	nvd
Patchstack	WordPress GenerateBlocks plugin <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata vulnerability	12 Dec 202521:59	–	patchstack
Positive Technologies	PT-2025-51042	13 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12512	14 Dec 202504:06	–	redhatcve
Vulnrichment	CVE-2025-12512 GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata	13 Dec 202503:20	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 8, 2025 to December 14, 2025)	19 Dec 202517:57	–	wordfence

Vulners

Node

edge22 generateblocksRange≤2.1.2wordpress

[
  {
    "vendor": "edge22",
    "product": "GenerateBlocks",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.1.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.1.1/includes/class-meta-handler.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/6affdb56-39cc-4749-b7cb-b80b7666f028
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.1.1/includes/class-meta-handler.php
plugins	www.plugins.trac.wordpress.org/changeset/3415721/generateblocks/trunk/includes/class-meta-handler.php
plugins	www.plugins.trac.wordpress.org/browser/generateblocks/tags/2.1.1/includes/class-meta-handler.php

Parameter	Position	Path	Description	CWE
user_id	query param	generateblocks/v1/meta/	Exposed REST route allows retrieving user meta without proper object-level authorization.	CWE-200
meta_key	query param	generateblocks/v1/meta/	Exposed REST route allows retrieving user meta without proper object-level authorization.	CWE-200

17 Jun 2026 08:32Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.14.3

EPSS0.00336

SSVC

CWE-200