CVE-2025-12586

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to enable or disable the site's maintenance mode via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
evolurise	Conditionnal Maintenance Mode for WordPress	<= 1.0.0

References

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-125874.3The Peer Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to CVE-2025-125884.3The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin CVE-2025-125896.1The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and incl CVE-2025-12597.7On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue CVE-2025-125906.1The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and inclu CVE-2025-125929.3Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.CVE-2025-125937.2A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of t CVE-2025-125947.2A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the fil CVE-2025-125959.8A weakness has been identified in Tenda AC23 16.03.07.52. This impacts the function formSetVirtualSer of the file /goform/SetVirtualServerCf CVE-2025-125969.8A security vulnerability has been detected in Tenda AC23 16.03.07.52. Affected is the function saveParentControlInfo of the file /goform/sav CVE-2025-125979.8A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_CVE-2025-125989.8A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the f