CVE-2025-12074 is an information exposure vulnerability in the Context Blog WordPress theme by postmagthemes. It affects all versions up to 1.2.5 and arises from inadequate access control in the 'context_blog_modal_popup' functionality. This allows unauthenticated attackers to retrieve content from posts that should be restricted, including password protected, private, or draft posts. The vulnerability has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating network exploitable with low attack complexity and no privileges required, resulting in limited confidentiality impact without affecting integrity or availability.

An attacker without authentication can access sensitive content from restricted posts, potentially exposing confidential or unpublished information. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the 'context_blog_modal_popup' feature or avoid using the vulnerable theme version. Monitor official postmagthemes communications for updates or patches addressing this vulnerability.