CVE-2025-12015: 
WordPress vulnerability analysis and mitigation

CVE-2025-12015 is a missing authorization vulnerability in the "Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed" WordPress plugin. The flaw affects all versions up to and including 2.0.0, allowing authenticated attackers with Subscriber-level access or above to perform unauthorized data modification by exploiting the unprotected wp_ajax_wpqai_disconnect_quicq_afosto AJAX endpoint. It was published on November 13, 2025, with Wordfence as the assigning CNA. The CVSS v3.1 base score is 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the plugin registers the wp_ajax_wpqai_disconnect_quicq_afosto AJAX action without performing a capability check to verify whether the requesting user has sufficient privileges to perform the operation. Any authenticated WordPress user — including those with the lowest default role (Subscriber) — can invoke this endpoint over the network with low attack complexity and no user interaction required. The missing check allows the caller to disconnect the plugin's integration with the Afosto image optimization service, constituting unauthorized modification of plugin configuration data (Wordfence).

Successful exploitation allows a low-privileged authenticated attacker to sever the WordPress site's connection to the Afosto image optimization service, disrupting the plugin's core functionality. The impact is limited to integrity (unauthorized configuration change); there is no confidentiality or availability impact reported. While not directly enabling remote code execution or data exfiltration, the disruption could degrade site performance (e.g., loss of image optimization/compression) and may serve as a stepping stone in a broader attack chain against the WordPress installation (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-12015. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session (Subscriber-level or above), which limits opportunistic mass exploitation but remains a realistic risk on sites with open user registration (Wordfence).

1. Obtain authenticated access: Register or log in to the target WordPress site with at least Subscriber-level credentials (exploitable on sites with open registration or compromised low-privilege accounts).
2. Identify the vulnerable endpoint: Confirm the "Quicq" plugin (version ≤ 2.0.0) is active on the target site by observing plugin-related assets or admin indicators.
3. Craft the AJAX request: Send an authenticated HTTP POST request to the WordPress AJAX handler, targeting the unprotected action:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: <target>
   Cookie: <authenticated session cookies>
   Content-Type: application/x-www-form-urlencoded
   
   action=wpqai_disconnect_quicq_afosto

4. Achieve unauthorized disconnection: The server processes the request without verifying the caller's capability, disconnecting the Afosto integration and modifying plugin configuration data (Wordfence).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with the parameter action=wpqai_disconnect_quicq_afosto originating from low-privilege user sessions or unusual IP addresses.
• Logs: WordPress access logs showing authenticated requests to admin-ajax.php with the above action from Subscriber-role accounts; repeated or automated requests to this endpoint.
• Application State: Sudden loss of Afosto/Quicq image optimization service connectivity on the WordPress site without administrator-initiated action; plugin settings showing the Afosto account as disconnected unexpectedly.

Users should update the "Convert WebP & AVIF | Quicq" WordPress plugin to a version beyond 2.0.0 that includes a proper capability check on the wp_ajax_wpqai_disconnect_quicq_afosto AJAX endpoint. If no patched version is yet available, site administrators should consider deactivating the plugin until a fix is released, or restricting WordPress user registration to prevent untrusted Subscriber-level accounts. Additionally, web application firewalls (WAFs) such as Wordfence can be configured to block unauthorized AJAX requests to this endpoint as a temporary mitigation (Wordfence, WordPress Plugin).

Wordfence disclosed and assigned this CVE as part of their weekly WordPress vulnerability report for November 10–16, 2025, categorizing it as a medium-severity issue (Wordfence Blog). No significant broader media coverage, researcher commentary, or social media discussion has been identified for this vulnerability, consistent with its low severity and limited exploitation potential.