CVE-2025-12170: 
WordPress vulnerability analysis and mitigation

CVE-2025-12170 is a Missing Authorization vulnerability in the Checkbox plugin for WordPress that allows unauthenticated attackers to clear plugin log files. It affects all versions of the Checkbox plugin up to and including 2.8.10. The vulnerability was published on November 21, 2025, and was reported by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, NVD).

The root cause is a missing capability check (CWE-862) on the wp_ajax_nopriv_checkbox_clean_log AJAX endpoint registered by the Checkbox plugin. WordPress AJAX endpoints registered with wp_ajax_nopriv_ are accessible to unauthenticated users by design, but the plugin fails to verify that the requesting user has appropriate permissions before executing the log-clearing action. An attacker only needs to send a crafted HTTP POST request to the WordPress AJAX handler (/wp-admin/admin-ajax.php) with the action parameter set to checkbox_clean_log — no authentication or special preconditions are required (Wordfence, NVD).

Successful exploitation allows any unauthenticated remote attacker to permanently delete the Checkbox plugin's log files, resulting in unauthorized data loss with a low integrity impact. The primary consequence is the destruction of audit trails and forensic evidence, which can hinder incident response investigations and compliance audits. There is no direct confidentiality or availability impact, and the vulnerability is scoped to the affected WordPress instance without enabling lateral movement or code execution (Wordfence, NVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12170. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Checkbox plugin (versions ≤ 2.8.10) using passive techniques such as checking /wp-content/plugins/checkbox/ for accessible files or using tools like WPScan.
2. Craft the AJAX request: Prepare an HTTP POST request targeting the WordPress AJAX endpoint at https://<target>/wp-admin/admin-ajax.php.
3. Set the action parameter: Include the POST body parameter action=checkbox_clean_log to invoke the vulnerable unauthenticated AJAX handler.
4. Send the request: Submit the request without any authentication cookies or tokens. The missing capability check means the server will process the request and clear the plugin's log files.
5. Verify impact: Confirm that log files have been cleared by checking any accessible log-related plugin pages or by observing the absence of log entries in the plugin's admin interface (Wordfence).

• Network: Unexpected HTTP POST requests to /wp-admin/admin-ajax.php with the body parameter action=checkbox_clean_log from unauthenticated (no session cookie) or unknown IP addresses.
• Logs: Sudden disappearance or truncation of Checkbox plugin log files on the server filesystem; web server access logs showing POST requests to admin-ajax.php with the above action from external IPs.
• File System: Checkbox plugin log files (typically located in the plugin's directory under wp-content/plugins/checkbox/) found empty or missing unexpectedly.

Users should update the Checkbox plugin to a version beyond 2.8.10, which includes the fix adding a proper capability check to the wp_ajax_nopriv_checkbox_clean_log endpoint. The patch is available via the WordPress plugin repository changeset. As a temporary workaround, site administrators can deactivate the Checkbox plugin until an update can be applied, or use a web application firewall (WAF) rule to block unauthenticated POST requests to admin-ajax.php with action=checkbox_clean_log (Wordfence, WordPress Changeset).