CVE-2025-12820
BaseFortify
Publication date: 2025-12-20
Last updated on: 2025-12-20
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | pure_wc_variation_swatches | 1.1.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Pure WC Variation Swatches WordPress plugin up to version 1.1.7. It occurs because the plugin does not perform proper authorization checks when updating its settings via AJAX requests. As a result, any authenticated user, regardless of their privilege level, can modify the plugin's settings without restriction by sending specially crafted POST requests to the plugin's AJAX endpoint. [1]
How can this vulnerability impact me? :
The vulnerability allows any authenticated user to change the plugin's settings arbitrarily. This could lead to unauthorized configuration changes that may affect the website's behavior, appearance, or security posture. Since even low-privileged users can exploit this flaw, it increases the risk of malicious or accidental misconfiguration, potentially compromising the integrity and reliability of the affected WordPress site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized POST requests to the endpoint /wp-admin/admin-ajax.php with the action parameter tpwvs_update_settings. Specifically, look for POST requests containing payloads such as tpwvs_general, tpwvs_shop, or tpwvs_style with arbitrary JSON data. A sample detection command using curl could be: curl -X POST -d 'action=tpwvs_update_settings&tpwvs_general={"pwned":"By Nxploited"}' https://yourwordpresssite.com/wp-admin/admin-ajax.php. Additionally, network monitoring tools or web application firewalls can be configured to alert on such requests. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no fix is currently available for this vulnerability, immediate mitigation steps include restricting access to the /wp-admin/admin-ajax.php endpoint to trusted users only, implementing additional access controls or firewall rules to block unauthorized POST requests to this endpoint, and monitoring logs for suspicious activity related to the tpwvs_update_settings action. Limiting authenticated user privileges to only those necessary can also reduce risk. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability impacts compliance with standards such as GDPR or HIPAA.