CVE-2025-12820: 
WordPress vulnerability analysis and mitigation

CVE-2025-12820 is a Missing Authorization vulnerability in the Pure WC Variation Swatches WordPress plugin (versions through 1.1.7) that allows any authenticated user to update plugin settings without proper authorization checks. The vulnerability was discovered by researcher Khaled Alenazi (Nxploited), added to WPScan on 2025-11-21, and publicly published on 2025-11-28, with CVE assignment on 2025-12-20. It carries a CVSS v3.1 base score of 5.3 (Medium), assessed by CISA-ADP (WPScan). As of the time of reporting, no patched version is available (WPScan).

The root cause is CWE-862 (Missing Authorization): the plugin's AJAX action tpwvs_update_settings does not perform any capability or role check before processing settings updates, violating the principle of least privilege (WPScan). An attacker only needs to be authenticated (any role, including subscriber) to send a crafted HTTP POST request to /wp-admin/admin-ajax.php?action=tpwvs_update_settings with arbitrary JSON payloads targeting settings groups such as tpwvs_general, tpwvs_shop, or tpwvs_style. This falls under OWASP Top 10 A5: Broken Access Control. A public proof-of-concept using curl commands is available via WPScan (WPScan).

Successful exploitation allows any authenticated WordPress user — regardless of their assigned role — to arbitrarily overwrite plugin settings for the Pure WC Variation Swatches plugin, affecting the general, shop, and style configuration groups. This can result in disruption of WooCommerce product variation display, potential defacement of product pages, or manipulation of storefront behavior, impacting the integrity of the affected WordPress site. Confidentiality and availability are not directly impacted, but integrity of plugin configuration is fully compromised for any authenticated attacker (WPScan).

A public proof-of-concept is available via WPScan, demonstrating exploitation with simple curl commands requiring only an authenticated session (WPScan). The EPSS score is approximately 0.017% (0.000170), indicating a low probability of widespread exploitation in the near term (Feedly). There is no evidence of in-the-wild exploitation, threat actor attribution, or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time.

1. Reconnaissance: Identify WordPress sites running the Pure WC Variation Swatches plugin (version ≤ 1.1.7) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Obtain authentication: Register or log in as any WordPress user (subscriber-level or higher) on the target site — no elevated privileges are required.
3. Craft malicious request: Prepare a POST request targeting the vulnerable AJAX endpoint with an arbitrary JSON payload for one of the affected settings groups (tpwvs_general, tpwvs_shop, or tpwvs_style).
4. Send the request: Execute the request using a tool such as curl:

curl -X POST 'https://target-site.com/wp-admin/admin-ajax.php?action=tpwvs_update_settings' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --cookie 'wordpress_logged_in_...=<session_cookie>' \
  --data-urlencode 'tpwvs_general={"pwned":"By Attacker"}'

5. Confirm impact: Verify that the plugin settings have been overwritten by checking the WooCommerce product variation display or querying the WordPress options table for the modified settings (WPScan).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with the query parameter action=tpwvs_update_settings from low-privileged user sessions or unusual IP addresses.
• Logs: WordPress access logs showing POST requests to admin-ajax.php?action=tpwvs_update_settings from subscriber or other low-privilege accounts; repeated or automated requests to this endpoint.
• Database: Unexpected or unauthorized changes to WordPress options entries corresponding to tpwvs_general, tpwvs_shop, or tpwvs_style keys in the wp_options table.

As of the time of reporting, there is no patched version of the Pure WC Variation Swatches plugin available (WPScan). Site administrators should consider deactivating and removing the plugin until a fix is released. As a workaround, restricting authenticated access to the WordPress admin AJAX endpoint or implementing a Web Application Firewall (WAF) rule to block requests to admin-ajax.php?action=tpwvs_update_settings from non-administrator users can reduce exposure. Monitor the WPScan vulnerability database and the plugin's official WordPress.org page for patch availability.

The vulnerability was reported and verified by security researcher Khaled Alenazi (Nxploited) and submitted to WPScan (WPScan). No significant vendor statements, notable researcher commentary beyond the original disclosure, or major media coverage have been identified for this vulnerability.