CVE-2025-12720
BaseFortify
Publication date: 2025-12-06
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| woocommerce | woocommerce | * |
| wordpress | g-ffl_cockpit | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The g-FFL Cockpit plugin for WordPress has a vulnerability in its handle_enqueue_only() function where IP-based authorization can be spoofed. This allows unauthenticated attackers to bypass security checks and delete arbitrary products.
How can this vulnerability impact me? :
This vulnerability can allow attackers who are not authenticated to delete arbitrary products from your WordPress site using the g-FFL Cockpit plugin, potentially causing data loss and disruption of your product listings.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the REST API endpoints `/wp-json/fflcockpit/v1/queue` and `/wp-json/fflcockpit/v1/process` that include spoofed HTTP headers such as `X-Forwarded-For` or `CF-Connecting-IP` set to the hardcoded IP address `3.212.185.187`. Detection can involve checking server logs or using curl commands to test if unauthorized deletion is possible by spoofing these headers. Example curl commands to test the vulnerability include sending a POST request to `/wp-json/fflcockpit/v1/queue` with the spoofed header and a JSON payload specifying product IDs to delete, followed by a POST request to `/wp-json/fflcockpit/v1/process` with the same spoofed header to trigger deletion. Monitoring for such requests or attempts to delete products via these endpoints with spoofed IP headers can help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or uninstalling the g-FFL Cockpit plugin version 1.7.1 or earlier until a patched version is available, as the vulnerability arises from improper IP-based authorization that can be spoofed. Additionally, restricting access to the REST API endpoints `/wp-json/fflcockpit/v1/queue` and `/wp-json/fflcockpit/v1/process` via firewall rules or web server configuration to trusted IPs can help prevent unauthorized access. Monitoring and blocking requests with spoofed `X-Forwarded-For` or `CF-Connecting-IP` headers matching the hardcoded IP address (`3.212.185.187`) is also recommended. Applying any official security updates or patches released by the plugin maintainers as soon as they become available is crucial. [1, 2]