CVE-2025-12582

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endpoint in all versions up to, and including, 0.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revert options.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Nov 5, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-125836.4The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'CVE-2025-125845.3The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via tCVE-2025-125855.3The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includCVE-2025-125864.3The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and iCVE-2025-125874.3The Peer Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to CVE-2025-125884.3The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includinCVE-2025-125896.1The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and inclCVE-2025-12597.7On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issueCVE-2025-125906.1The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and incluCVE-2025-125929.3Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.CVE-2025-125937.2A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of tCVE-2025-125947.2A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the fil
CVE-2025-12582: Medium severity, CVSS 4.3 | Vulnix