CVE-2025-12168: 
WordPress vulnerability analysis and mitigation

CVE-2025-12168 is a Missing Authorization vulnerability in the Phrase TMS Integration for WordPress plugin (formerly Memsource Connector) that allows authenticated attackers with Subscriber-level access or above to delete log files without proper authorization. It affects all versions of the plugin up to and including 4.7.5. The vulnerability was disclosed on January 17, 2026, and assigned a CVSS v3.1 base score of 4.3 (Medium) by Wordfence (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the wp_ajax_delete_log AJAX endpoint within the plugin. WordPress AJAX endpoints registered without proper current_user_can() or equivalent capability verification can be invoked by any authenticated user, regardless of their role. An attacker with a Subscriber-level WordPress account (the lowest authenticated role) can send a crafted POST request to the admin-ajax.php endpoint with the action delete_log to trigger unauthorized log file deletion. The patch was applied in plugin changeset 3426034 (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to delete plugin log files, resulting in a low integrity impact with no confidentiality or availability consequences. The primary risk is log tampering — an attacker could erase evidence of prior malicious activity recorded by the Phrase TMS Integration plugin, potentially hindering forensic investigations. The scope is limited to the plugin's log files and does not enable code execution, data exfiltration, or privilege escalation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12168. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. The vulnerability requires authentication (at minimum a Subscriber account), which further limits the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Obtain Authenticated Access: Register or obtain a Subscriber-level (or higher) account on the target WordPress site running Phrase TMS Integration plugin version ≤ 4.7.5.
2. Identify the AJAX Endpoint: Confirm the plugin is active by checking for its presence in the WordPress admin or via plugin enumeration techniques.
3. Craft the Malicious Request: Send a POST request to https://[target]/wp-admin/admin-ajax.php with the body parameter action=delete_log and any required nonce or log file identifier (if applicable), using the authenticated session cookie.
4. Delete Log Files: The server processes the request without verifying the user's capability, resulting in the deletion of the targeted plugin log file(s).
5. Cover Tracks: The deleted logs may remove evidence of prior activity recorded by the plugin, aiding in defense evasion (Wordfence).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=delete_log from low-privileged user accounts or unexpected IP addresses.
• Logs: Absence of expected Phrase TMS Integration plugin log files on the server filesystem; gaps in plugin activity logging that do not correspond to normal operations.
• Web Server Logs: Repeated or anomalous requests to admin-ajax.php from Subscriber-level user sessions, particularly outside of normal business hours.

Users should update the Phrase TMS Integration for WordPress plugin to a version beyond 4.7.5, which includes the fix applied in changeset 3426034 on the WordPress plugin repository. No configuration-based workaround is available short of deactivating the plugin. Site administrators should also audit user accounts with Subscriber-level access and review plugin log files for unexpected deletions (WordPress Trac, Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 17, 2026. Coverage has been limited to automated vulnerability aggregators and security feeds, with no notable researcher commentary or significant media coverage, consistent with the low severity rating of the issue (Wordfence).