CVE-2025-12072

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12072", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T14:07:11.906Z", "datePublished": "2025-10-24T08:23:56.994Z", "dateUpdated": "2026-04-08T16:42:10.290Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:10.290Z"}, "affected": [{"vendor": "mynamevenu24", "product": "Disable Content Editor For Specific Template", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or delete template configurations via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "title": "Disable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/243200f4-5a5d-4275-bf2b-f4cb6099d145?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/disable-contect-editor-for-specific-template/tags/2.0/disable-editor-specific-template.php#L57"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-10-23T20:09:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-24T16:38:44.483378Z", "id": "CVE-2025-12072", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T16:45:11.243Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T16:38:44.483378Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T16:39:58.394Z"}}], "cna": {"title": "Disable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Update", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "mynamevenu24", "product": "Disable Content Editor For Specific Template", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-23T20:09:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/243200f4-5a5d-4275-bf2b-f4cb6099d145?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/disable-contect-editor-for-specific-template/tags/2.0/disable-editor-specific-template.php#L57"}], "descriptions": [{"lang": "en", "value": "The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or delete template configurations via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-24T08:23:56.994Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12072", "state": "PUBLISHED", "dateUpdated": "2025-10-24T16:45:11.243Z", "dateReserved": "2025-10-22T14:07:11.906Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-24T08:23:56.994Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Disable Content Editor For Specific Template", "vendor": "mynamevenu24", "versions": [{"lessThanOrEqual": "2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or delete template configurations via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Disable Content Editor For Specific Template para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 2.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en las actualizaciones de configuraci\u00f3n de plantillas. Esto hace posible que atacantes no autenticados a\u00f1adan o eliminen configuraciones de plantillas a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12072", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12072", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-24T16:38:44.483378Z", "version": "2.0.3"}}]}, "published": "2025-10-24T09:15:44.733", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/disable-contect-editor-for-specific-template/tags/2.0/disable-editor-specific-template.php#L57"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/243200f4-5a5d-4275-bf2b-f4cb6099d145?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:55:05.996128+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to a version newer than 2.0 if one is available, ensuring that nonce validation is implemented for configuration changes.", "If an update is not available or delayed, uninstall or deactivate the plugin to prevent the vulnerable functionality from being used.", "Implement additional safeguards such as two\u2011factor authentication for administrator accounts and carefully review any external links in emails or on the site to reduce the risk of a phishing click that could trigger the CSRF."], "summary": {"action": "Patch Plugin", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin \"Disable Content Editor For Specific Template\" produced by the vendor mynamevenu24, for all releases up to and including version 2.0. No other product versions are listed as affected.", "description_and_impact": "The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross\u2011Site Request Forgery through an omission of nonce validation when a template configuration is updated. An unauthenticated attacker can cause an administrator to unintentionally add or delete template configuration entries by sending a forged request, such as a malicious link, that the admin follows. This change to configuration can alter how content is displayed or managed on the site without the admin\u2019s consent.", "risk_and_exploitability": "The CVSS score of 4.3 categorizes this risk as moderate, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to entice an administrator into clicking a crafted URL or otherwise submitting a forged request, making the attack vector social\u2011engineering or phishing based. Based solely on the information provided, the exploitation can be carried out by an unauthenticated actor who successfully deceives an admin to trigger the template configuration update."}}}}, "created": "2025-10-27T22:13:12.971994+00:00", "updated": "2026-04-22T22:00:18.087092+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}