CVE-2025-12128: 
WordPress vulnerability analysis and mitigation

CVE-2025-12128 is a Cross-Site Request Forgery (CSRF) vulnerability in the "Hide Categories Or Products On Shop Page" plugin for WordPress, affecting all versions up to and including 1.0.7. The flaw allows unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a malicious link, which triggers a forged request. It was published on December 5, 2025, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing or incorrect nonce validation on the save_data_hcps() function within the plugin, classified as CWE-352 (Cross-Site Request Forgery). Because the function does not verify a WordPress nonce before processing settings updates, an attacker can craft a forged HTTP request that, when executed in the context of an authenticated administrator's browser session, will update the plugin's configuration without authorization. Exploitation requires social engineering — the attacker must trick a logged-in administrator into visiting a malicious page or clicking a crafted link (Wordfence, ENISA EUVD).

Successful exploitation allows an unauthenticated attacker to alter the shop page configuration of a WooCommerce-enabled WordPress site, such as hiding or showing specific categories or products without authorization. The primary impact is on integrity (low), as plugin settings can be manipulated to disrupt the store's product visibility, potentially affecting business operations or deceiving customers. There is no direct confidentiality or availability impact, and lateral movement potential is limited to the scope of the plugin's functionality (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction from a site administrator, which significantly limits the attack surface (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the "Hide Categories Or Products On Shop Page" plugin at version 1.0.7 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Create an HTML page or link containing a forged form or auto-submitting request targeting the plugin's settings endpoint (invoking save_data_hcps()) with attacker-controlled parameter values.
3. Social engineering: Deliver the malicious link to a site administrator via email, forum post, or other communication channel, enticing them to click it while logged into the WordPress admin panel.
4. Settings modification: When the administrator's browser executes the forged request, the plugin's settings are updated without nonce verification, allowing the attacker to manipulate which product categories or products are hidden on the shop page (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to the plugin's settings-saving endpoint (save_data_hcps) originating from unusual referrers or external domains.
• Application: Unexplained changes to the "Hide Categories Or Products On Shop Page" plugin settings in the WordPress admin panel, particularly if no administrator recalls making such changes.
• Network: Requests to the WordPress admin-ajax or options endpoint associated with the plugin arriving from external or unfamiliar IP addresses in web server logs.

Users should update the "Hide Categories Or Products On Shop Page" plugin to version 1.0.8 or later, which addresses the missing nonce validation in the save_data_hcps() function. As a general precaution, WordPress administrators should avoid clicking unsolicited links while logged into the admin panel and consider using security plugins that provide additional CSRF protection. No configuration-based workaround is available for the vulnerable versions (Wordfence, WordPress Plugin Page).