Is CVE-2025-70129 actively exploited?

No active exploitation of CVE-2025-70129 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-70129 be exploited remotely?

Yes. CVE-2025-70129 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-70129?

CVE-2025-70129 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2025-70129

MEDIUM

CVE-2025-70129

Published: March 10, 2026· Updated: Mar 11, 2026

5.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.5th

Official Description

If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.

NVD Source

Technical Analysis

CVE-2025-70129 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.