CVE-2025-12061: 
WordPress 脆弱性の分析と軽減

The TAX SERVICE Electronic HDM WordPress plugin before version 1.2.1 contains a critical security vulnerability identified as CVE-2025-12061. The vulnerability was discovered and publicly published on November 5, 2025. The issue affects the plugin's AJAX functionality, which lacks proper authorization and CSRF checks (WPScan).

The vulnerability stems from missing authorization and CSRF checks in an AJAX action within the plugin. This security flaw specifically involves the 'importTaxService' AJAX endpoint, which allows for the execution of arbitrary SQL statements. The vulnerability has been classified under CWE-862 (Authorization Bypass) and received a CVSS score of 8.6 (High) (WPScan).

The vulnerability allows unauthenticated users to import and execute arbitrary SQL statements on the affected WordPress installation. This can lead to complete database compromise, including the ability to create unauthorized administrator accounts, modify existing user permissions, and potentially take full control of the WordPress site (WPScan).

The vulnerability has been patched in version 1.2.1 of the TAX SERVICE Electronic HDM plugin. Site administrators are strongly advised to update to this version immediately. No alternative workarounds have been published (WPScan).