CVE-2025-12091
BaseFortify
Publication date: 2025-12-06
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fast_simon | instantsearch-for-woocommerce | 3.0.64 |
| fast_simon | instantsearch-for-woocommerce | 3.0.65 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Search, Filters & Merchandising for WooCommerce plugin for WordPress, where a missing capability check on the 'wcis_save_email' endpoint allows authenticated users with Subscriber-level access or higher to modify data unauthorizedly. Specifically, such users can deactivate the plugin despite having limited privileges.
How can this vulnerability impact me? :
An attacker with Subscriber-level access or above can exploit this vulnerability to deactivate the plugin, potentially disrupting the functionality of search, filters, and merchandising features on your WooCommerce site. This could lead to degraded user experience or loss of important e-commerce capabilities.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized modification of data via the 'wcis_save_email' endpoint in the WooCommerce Search, Filters & Merchandising plugin. Detection can focus on monitoring HTTP requests to the 'wcis_save_email' endpoint for suspicious activity, especially requests made by users with Subscriber-level access or higher. Network monitoring tools or web server logs can be used to identify such requests. Specific commands depend on your environment, but examples include using curl to test the endpoint or grep to search logs for 'wcis_save_email'. For example, to check web server logs for access to this endpoint: `grep 'wcis_save_email' /var/log/apache2/access.log` or `grep 'wcis_save_email' /var/log/nginx/access.log`. To test the endpoint manually: `curl -X POST https://yourdomain.com/wp-admin/admin-ajax.php?action=wcis_save_email` (adjust URL as appropriate).
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Search, Filters & Merchandising for WooCommerce plugin to a version later than 3.0.63 where the missing capability check on the 'wcis_save_email' endpoint is fixed. If an update is not immediately available, restrict access to the 'wcis_save_email' endpoint to trusted users only, for example by limiting access via web server rules or security plugins. Additionally, review user roles and permissions to ensure that Subscriber-level users do not have unnecessary access that could be exploited. Monitoring and alerting on suspicious activity targeting this endpoint is also recommended.