External risk intelligence

TNC Toolbox WordPress Plugin Exposes cPanel Credentials

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-12539

The vulnerability affects a WordPress plugin which, by definition, operates within a web-facing application. The exposure involves credentials stored in a directory within the web-accessible wp-content folder, making them reachable via standard web requests to the public-facing site.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the TNC Toolbox: Web Performance plugin for WordPress, which could expose sensitive credentials. This exposure allows unauthenticated attackers to potentially gain control of the hosting environment, leading to serious security breaches.

Sensitive plugin credentials are exposed online.
Affects WordPress sites using the TNC Toolbox plugin.
Confirm relevance and assess exposure to hosting environments.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing web-exposed files containing sensitive cPanel API credentials stored by the TNC Toolbox plugin. Once these credentials are obtained, the attacker can leverage them to interact with the cPanel API, potentially leading to severe impacts on the hosting environment.

Unauthenticated attackers can access exposed credentials.
Stored credentials grant access to cPanel API.
Full hosting compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could access cPanel API credentials stored in web-accessible files. This exposure allows attackers to potentially interact with the cPanel API, leading to actions such as arbitrary file uploads or remote code execution on the hosting environment.

cPanel API credentials.
Stored in web-accessible files.
Full hosting environment compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability. The first practical step is to identify all instances of the affected WordPress plugin, confirm if they are exposed to the internet, and determine business criticality. Once identified, the accountable owner should be confirmed, and a remediation plan, considering vendor coordination and maintenance windows, should be established.

Application owners should manage remediation.
Verify internet-facing plugin instances first.
Plan coordinated vendor updates and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TNC Toolbox: Web Performance plugin?

This WordPress plugin is designed to manage web performance settings. It includes features that interface with external hosting management tools like cPanel. By automating these connections, it stores sensitive configuration data, such as API credentials, to allow the WordPress dashboard to communicate directly with your hosting environment.

What does CWE-922 mean for CVE-2025-12539?

CWE-922 refers to Insecure Storage of Sensitive Information. In the context of this CVE, the plugin saves critical cPanel access keys in a directory that is served by your web server. Instead of keeping these secrets in a protected or non-web-accessible location, the software places them where they can be inadvertently downloaded by anyone browsing your site's structure.

How do attackers trigger this vulnerability?

An attacker does not need any special privileges or login access to your site. They simply need to know or guess the path to the file where the plugin stores its settings within the wp-content directory. If the file is placed in a web-accessible folder without specific server-level blocks, a standard HTTP request is all it takes to retrieve the plaintext credentials.

Is my site at risk according to Halo Surface Signal?

Yes, if your site is internet-facing, this vulnerability is highly relevant. Halo Surface Signal identifies this as a likely risk because the plugin files reside in the public-facing wp-content directory. Because these folders are designed to be reachable over the network, any credentials stored there are directly exposed to anyone on the internet.

What should I do if I use this plugin?

First, verify if your WordPress site has the TNC Toolbox plugin installed and active. If it is, locate where it stores configuration files to check for credential exposure. Since these credentials provide full access to your hosting environment, prioritize rotating any cPanel API keys or passwords that were saved by the plugin, then coordinate with your team to remove or update the software.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.