CVE-2025-12391: 
WordPress vulnerability analysis and mitigation

CVE-2025-12391 is a Missing Authorization vulnerability in the Restrictions for BuddyPress plugin for WordPress, affecting all versions up to and including 1.5.2. The flaw allows unauthenticated remote attackers to perform unauthorized data modification by exploiting a missing capability check on the handle_optin_optout() function. It was published on November 18, 2025, with the assigner credited as Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization): the handle_optin_optout() function in the Restrictions for BuddyPress plugin does not verify whether the requesting user has the appropriate capability before processing the request. Because no authentication or privilege check is enforced, any unauthenticated network attacker can send a crafted HTTP request to invoke this function and toggle tracking opt-in/opt-out settings for arbitrary users. No special preconditions — such as an existing account or prior access — are required for exploitation (Wordfence, ENISA EUVD).

Successful exploitation allows an unauthenticated attacker to modify tracking opt-in/opt-out data for site users, resulting in a low integrity impact with no confidentiality or availability consequences. The scope is limited to the plugin's tracking preference data and does not enable code execution, privilege escalation, or access to sensitive information. While the direct impact is limited, unauthorized manipulation of user tracking preferences could undermine consent management and compliance posture on affected WordPress sites (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-12391. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (0.000380), indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Restrictions for BuddyPress plugin (version ≤ 1.5.2) using passive scanning tools (e.g., WPScan, Shodan) or by checking publicly accessible plugin metadata at /wp-content/plugins/bp-restrict/.
2. Identify the vulnerable endpoint: Locate the AJAX action or REST endpoint that invokes the handle_optin_optout() function within the plugin — typically registered via WordPress's wp_ajax_nopriv_ hook, making it accessible without authentication.
3. Craft the request: Send a crafted HTTP POST request to wp-admin/admin-ajax.php (or equivalent endpoint) with the appropriate action parameter targeting the opt-in/opt-out handler, along with any required nonce or user identifier parameters.
4. Modify tracking preferences: The server processes the request without verifying user capabilities, allowing the attacker to toggle tracking opt-in or opt-out status for targeted or arbitrary users (Wordfence).

• Network: Unusual or repeated unauthenticated POST requests to wp-admin/admin-ajax.php with action parameters related to opt-in/opt-out tracking from unexpected IP addresses.
• Logs: WordPress access logs showing POST /wp-admin/admin-ajax.php requests with no authenticated session cookie, particularly targeting the handle_optin_optout action.
• Application: Unexpected changes to user tracking preferences (opt-in/opt-out status) in the BuddyPress or plugin database tables without corresponding user-initiated actions.

Users should update the Restrictions for BuddyPress plugin to a version beyond 1.5.2 that includes a capability check on the handle_optin_optout() function. Check the WordPress plugin repository for the latest patched release. If an update is not immediately available, consider temporarily deactivating the plugin or using a Web Application Firewall (WAF) rule to block unauthenticated requests to the affected AJAX endpoint (Wordfence, WordPress Plugin).