Security Alert Summary
The Oxygen Theme for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability via the laborator_calc_route AJAX action. Unauthenticated attackers can cause the site to make requests to arbitrary locations from the web application, which can be used to query or modify information on internal services.
CVE Details
- CVE ID:
CVE-2025-12886 - Affected component: Oxygen Theme (theme for WordPress)
- Affected versions: all versions up to and including 6.0.8
- Published: March 28, 2026 at 4:16:49 AM UTC
- Last modified: March 28, 2026 at 4:16:49 AM UTC
- CVSS v3.1: Base score 7.2 (HIGH), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction: No authentication required; Privileges Required: None; User Interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-918
Technical Details
The vulnerability is a Server-Side Request Forgery (SSRF) in the Oxygen Theme that exists in the laborator_calc_route AJAX action. Because the AJAX action can be triggered without authentication, an attacker can cause the web application to make HTTP requests to arbitrary targets from the server’s network context. The request origin will be the web application host, which can allow access to internal services that are not exposed externally.
The weakness allows attackers to query internal endpoints or services reachable from the hosting environment and, depending on those services, may allow reading or influencing data. The CVE description notes the ability to “query and modify information from internal services,” which aligns with the documented confidentiality and integrity impacts. There is no indication in the provided data of direct impact to availability.
How This Could Impact Your Website
Consider a small business site where the owner manages content, internal staff maintain product information, and an external contractor performs occasional updates. An unauthenticated attacker exploiting this SSRF could use the site to probe internal network services, potentially discovering internal APIs, admin interfaces, or metadata endpoints that are not intended to be public.
Practical consequences include exposure of internal endpoints and limited internal data, which can increase the risk of targeted phishing or social engineering if email addresses or other contact information are accessible. Because the integrity impact is rated as low, this vulnerability does not necessarily imply a complete site takeover, but it can provide information that aids further attacks.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin or theme as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site and server activity for unusual requests or outbound connections originating from the web application.
If you’re unsure how to proceed or would like assistance, our team at Freshy is happy to help.
