CVE-2025-10212

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10212", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-10T10:41:29.995Z", "datePublished": "2025-10-03T11:17:06.242Z", "dateUpdated": "2026-04-08T16:33:47.771Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:47.771Z"}, "affected": [{"vendor": "sitealert", "product": "SiteAlert (Formerly WP Health)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc."}], "title": "SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D01EXPLOIT OFFICIAL"}], "timeline": [{"time": "2025-08-27T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-02T21:55:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T15:59:07.620170Z", "id": "CVE-2025-10212", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T15:59:19.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10212", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T15:59:07.620170Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T15:59:14.655Z"}}], "cna": {"title": "SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "D01EXPLOIT OFFICIAL"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "sitealert", "product": "SiteAlert (Formerly WP Health)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-27T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-02T21:55:46.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159"}, {"url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144"}], "descriptions": [{"lang": "en", "value": "The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:47.771Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10212", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:33:47.771Z", "dateReserved": "2025-09-10T10:41:29.995Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:06.242Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SiteAlert (Formerly WP Health)", "vendor": "sitealert", "versions": [{"lessThanOrEqual": "1.9.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc."}, {"lang": "es", "value": "El plugin SiteAlert (anteriormente WP Health) para WordPress es vulnerable a acceso no autorizado a datos debido a una comprobaci\u00f3n de capacidad faltante en m\u00faltiples funciones en todas las versiones hasta la 1.9.8, inclusive. Esto permite a atacantes no autenticados ver la informaci\u00f3n de salud del sitio, incluyendo una lista de plugins instalados y desactualizados, la versi\u00f3n de PHP y de la base de datos, etc."}], "id": "CVE-2025-10212", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10212", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T15:59:07.620170Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:42.100", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:45:58.825973+00:00", "value": {"mitigation_remediation": ["Update SiteAlert to a version newer than 1.9.8 to apply the missing capability check.", "If an immediate update is not possible, block unauthenticated access to the plugin\u2019s AJAX endpoints by configuring a web application firewall or adding .htaccess rules that restrict access to authenticated users.", "If the plugin is not essential, consider disabling or removing it entirely to eliminate the exposure."], "summary": {"action": "Patch Update", "impact": "Unauthorized disclosure of site health data"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the SiteAlert (Formerly WP Health) WordPress plugin for all releases up to and including version 1.9.8. Users running any of these versions on a WordPress installation are potentially exposed unless the plugin is upgraded or protected by external means.", "description_and_impact": "The SiteAlert (Formerly WP Health) plugin for WordPress has a missing capability check on several AJAX functions in all versions up to and including 1.9.8. This weakness allows anyone on the internet who can send unauthenticated HTTP requests to these endpoints to view detailed site health information, such as the list of installed plugins, which plugins are outdated, the PHP version, and the database version. The disclosure of this information can be leveraged in subsequent targeted attacks, as it provides a ready inventory of potential attack vectors and system configuration details.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate overall impact, and the EPSS score of less than 1% reflects a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can reach the vulnerable AJAX endpoints via unauthenticated HTTP requests, thereby reading the site health data without needing any credentials."}}}}, "created": "2025-10-06T14:42:52.958911+00:00", "updated": "2026-04-28T00:00:18.094996+00:00", "vendors": ["sitealert", "sitealert$PRODUCT$sitealert", "wordpress", "wordpress$PRODUCT$wordpress"]}