BaseFortify

Publication date: 2025-11-07

Last updated on: 2025-11-12

Assigner: Wordfence

Description

The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12527

EUVD

EUVD-2025-38235

Affected Vendors & Products

Vendor	Product	Version / Range
yydevelopment	page_post_notes	1.3.5
yydevelopment	page_post_notes	1.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Page & Post Notes plugin for WordPress, where a missing capability check in the 'yydev_notes_save_dashboard_data' function allows authenticated users with Subscriber-level access or higher to modify notes without proper authorization.

Impact Analysis

An attacker with at least Subscriber-level access can modify notes within the plugin, potentially leading to unauthorized changes or misinformation being saved, which could affect the integrity of the data managed by the plugin.

Hi! I’m here to help you understand CVE-2025-12527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70