Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path
high
The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to...
- CVSS:
- 7.2
- Affected:
- up to 6.0.8
- Fixed in:
- 6.0.9
- Disclosed:
- Mar 27, 2026
CVE-2025-12886 on NVD →
Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery
high
The Oxygen theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal s...
- CVSS:
- 7.2
- Affected:
- up to 6.0.8
- Fix:
- No patched version reported
- Disclosed:
- Jan 27, 2026
CVE-2025-69299 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database