CVE-2025-12539 Information disclosure in TNC Toolbox: Web Performance
Unauthenticated attackers can retrieve exposed cPanel credentials from web-accessible files, leading to account takeover and remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12539?
CVE-2025-12539 is a critical vulnerability in leopardhost TNC Toolbox: Web Performance, published on 11 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
Weakness: CWE-922
Which versions are affected by CVE-2025-12539?
How do I fix CVE-2025-12539?
No fix has been published for CVE-2025-12539 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12539 being exploited?
There is no known exploitation of CVE-2025-12539 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-92c8-jh9m-53gp.