CVE-2025-12168
BaseFortify
Publication date: 2026-01-17
Last updated on: 2026-01-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| memsource | memsource-connector | to 4.7.5 (inc) |
| memsource | memsource-connector | 4.7.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Phrase TMS Integration for WordPress plugin allows authenticated users with Subscriber-level access or higher to delete log files without proper authorization. This happens because the plugin's AJAX endpoint 'wp_ajax_delete_log' lacks a capability check, meaning it does not verify if the user has permission to perform this action. The issue was fixed in version 4.7.6 by adding nonce verification and capability checks to ensure only authorized users can delete logs. [1]
How can this vulnerability impact me? :
An attacker with at least Subscriber-level access could exploit this vulnerability to delete log files, potentially removing important records of system activity or security events. This could hinder incident response, auditing, and troubleshooting efforts, and may allow malicious actions to go undetected. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation uses the Phrase TMS Integration (memsource-connector) plugin version 4.7.5 or earlier. To confirm, run a command to list installed plugins and their versions, such as: `wp plugin list --format=json | jq '.[] | select(.name=="memsource-connector")'`. Additionally, monitoring AJAX requests to the 'wp_ajax_delete_log' endpoint for unauthorized access attempts could help detect exploitation attempts. However, specific detection commands for network traffic or logs are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the memsource-connector plugin to version 4.7.6 or later, which includes patches that add nonce verification and capability checks to the AJAX endpoints, preventing unauthorized log deletion. Ensure that only users with the 'manage_options' capability can perform sensitive actions. If updating immediately is not possible, restrict access to the AJAX endpoints or limit user roles to prevent Subscriber-level users from exploiting the vulnerability. [1]