CVE-2025-12585 is a vulnerability in the MxChat – AI Chatbot & Content Generation for WordPress plugin affecting all versions up to and including 2.5.5. The issue arises from improper handling of upload filenames, which allows unauthenticated attackers to extract session values. These session values can then be used to access conversation data that should be protected. The vulnerability is categorized under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS 3.1 base score is 5.3, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch link available at this time, and the plugin is not a cloud service, so remediation must be managed by site administrators.

The vulnerability allows unauthorized disclosure of session information, which can lead to unauthorized access to conversation data within the chatbot plugin. This exposure compromises confidentiality but does not affect integrity or availability. Since no privileges or user interaction are required, the risk of exploitation is moderate. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting access to upload functionalities or sensitive plugin directories, and monitor for unusual access patterns related to the chatbot plugin. Avoid exposing upload filenames publicly. Follow vendor communications closely for updates on patches or official mitigations.