CVE-2025-12376 is a Server-Side Request Forgery vulnerability in the Icon List Block – Add Icon-Based Lists with Custom Styles WordPress plugin by bplugins. The issue exists in all versions up to and including 1.2.1 and is exploitable via the fs_api_request function. Attackers with low-level authenticated access (Subscriber or above) can cause the server to make arbitrary HTTP requests to internal or external systems. The vulnerability allows reading and modifying information from internal services, with responses limited to valid JSON objects. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and low confidentiality and integrity impact.

An attacker with Subscriber-level access can leverage this SSRF vulnerability to make the server perform arbitrary HTTP requests, potentially accessing or manipulating internal services that are otherwise inaccessible externally. This can lead to unauthorized information disclosure and modification within the internal network. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict Subscriber-level user permissions where possible and monitor for suspicious activity related to the plugin. Review and limit internal service exposure to reduce potential impact.