CVE-2025-12189 is a CSRF vulnerability in the Bread & Butter: AI-Powered Lead Intelligence WordPress plugin affecting all versions up to 7.11.1374. The vulnerability is due to missing or incorrect nonce validation on the uploadImage() function, enabling unauthenticated attackers to upload arbitrary files if they can induce an administrator to perform a forged request. This could lead to remote code execution on the affected site. The CVSS 3.1 base score is 4.3, reflecting a medium severity level with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files by exploiting the CSRF vulnerability, potentially leading to remote code execution if an administrator is tricked into performing a specific action. This compromises the integrity and security of the affected WordPress site. There is no indication of confidentiality or availability impact in the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and actions performed by users, especially avoiding clicking untrusted links while logged in as an administrator. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.