CVE-2025-12137

1 Helper to call the plugin’s REST API with current nonce async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path, method, headers:...