CVE-2025-12388 is a Server-Side Request Forgery vulnerability in the B Carousel Block – Responsive Image and Content Carousel WordPress plugin, affecting versions up to 1.1.5. The issue arises from insufficient validation of user-supplied URLs before passing them to the wp_remote_request() function, allowing authenticated users with subscriber-level privileges or higher to induce the server to send arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services accessible from the server. The CVSS 3.1 base score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity but no impact on availability. No patch or official vendor advisory is currently documented.

An authenticated attacker with subscriber-level access or higher can exploit this vulnerability to make the server perform arbitrary HTTP requests to internal or external systems. This can lead to unauthorized information disclosure or modification of internal services that are otherwise inaccessible externally. The vulnerability does not impact availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user access where possible and monitor for suspicious activity related to the plugin. Avoid using untrusted URLs in the plugin's functionality. Follow updates from the plugin vendor or WordPress security channels for patch availability.