Wiz
Vulnerability DatabaseCVE-2025-12061

CVE-2025-12061: 
WordPress vulnerability analysis and mitigation

Overview

The TAX SERVICE Electronic HDM WordPress plugin before version 1.2.1 contains a critical security vulnerability identified as CVE-2025-12061. The vulnerability was discovered and publicly published on November 5, 2025. The issue affects the plugin's AJAX functionality, which lacks proper authorization and CSRF checks (WPScan).

Technical details

The vulnerability stems from missing authorization and CSRF checks in an AJAX action within the plugin. This security flaw specifically involves the 'importTaxService' AJAX endpoint, which allows for the execution of arbitrary SQL statements. The vulnerability has been classified under CWE-862 (Authorization Bypass) and received a CVSS score of 8.6 (High) (WPScan).

Impact

The vulnerability allows unauthenticated users to import and execute arbitrary SQL statements on the affected WordPress installation. This can lead to complete database compromise, including the ability to create unauthorized administrator accounts, modify existing user permissions, and potentially take full control of the WordPress site (WPScan).

Mitigation and workarounds

The vulnerability has been patched in version 1.2.1 of the TAX SERVICE Electronic HDM plugin. Site administrators are strongly advised to update to this version immediately. No alternative workarounds have been published (WPScan).

Additional resources

Source: This report was generated using AI

Related WordPress vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-13597CRITICAL9.8
  • ai-feeds
NoYesNov 25, 2025
CVE-2025-13595CRITICAL9.8
  • cibeles-ai
NoYesNov 25, 2025
CVE-2025-13414MEDIUM5.3
  • chamber-dashboard-business-directory
NoNoNov 25, 2025
CVE-2025-13452MEDIUM4.3
  • admin-and-client-message-after-order-for-woocommerce
NoNoNov 25, 2025
CVE-2025-12061N/AN/A
  • virtual-hdm-for-taxservice-am
NoYesNov 26, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo