CVE-2025-12091

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12091", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T18:40:47.777Z", "datePublished": "2025-12-06T05:49:34.648Z", "dateUpdated": "2026-04-08T17:27:22.758Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:22.758Z"}, "affected": [{"vendor": "instantsearchplus", "product": "Search, Filters & Merchandising for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.0.67", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin."}], "title": "Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/daa8f941-6e87-4b94-8526-f73770fe6f82?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/instantsearch-for-woocommerce/tags/3.0.64/public/wcis_plugin.php#L1074"}, {"url": "https://plugins.trac.wordpress.org/browser/instantsearch-for-woocommerce/trunk/public/wcis_plugin.php#L1074"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415224/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-12-05T17:19:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-08T21:29:36.251255Z", "id": "CVE-2025-12091", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:29:47.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12091", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T21:29:36.251255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:29:42.611Z"}}], "cna": {"title": "Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "instantsearchplus", "product": "Search, Filters & Merchandising for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.67"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-05T17:19:21.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/daa8f941-6e87-4b94-8526-f73770fe6f82?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/instantsearch-for-woocommerce/tags/3.0.64/public/wcis_plugin.php#L1074"}, {"url": "https://plugins.trac.wordpress.org/browser/instantsearch-for-woocommerce/trunk/public/wcis_plugin.php#L1074"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415224/"}], "descriptions": [{"lang": "en", "value": "The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:22.758Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12091", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:22.758Z", "dateReserved": "2025-10-22T18:40:47.777Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-06T05:49:34.648Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Search, Filters & Merchandising for WooCommerce", "vendor": "instantsearchplus", "versions": [{"lessThanOrEqual": "3.0.67", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin."}, {"lang": "es", "value": "El plugin Search, Filters & Merchandising for WooCommerce para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en el endpoint 'wcis_save_email' en todas las versiones hasta la 3.0.63, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, desactiven el plugin."}], "id": "CVE-2025-12091", "lastModified": "2026-10-15T20:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12091", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-08T21:29:36.251255Z", "version": "2.0.3"}}]}, "published": "2025-12-06T06:15:48.990", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/instantsearch-for-woocommerce/tags/3.0.64/public/wcis_plugin.php#L1074"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/instantsearch-for-woocommerce/trunk/public/wcis_plugin.php#L1074"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3415224/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/daa8f941-6e87-4b94-8526-f73770fe6f82?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:37:23.644887+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to a version newer than 3.0.67 where the capability check has been restored.", "If an upgrade is unavailable, disable or remove the Search, Filters & Merchandising for WooCommerce plugin to prevent unauthorized deactivation.", "Limit Subscriber\u2011level access to trusted users only, or implement role restrictions so that only administrators can reach the affected endpoint."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Plugin Deactivation"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in all releases of the Search, Filters & Merchandising for WooCommerce plugin up to and including version 3.0.67. Systems running any of these versions on WordPress are susceptible if an attacker can authenticate with a Subscriber or higher role.", "description_and_impact": "The Search, Filters & Merchandising for WooCommerce plugin contains a missing capability check on the \"wcis_save_email\" endpoint, allowing attackers who are Authenticated with Subscriber-level access or higher to deactivate the plugin. This capability misconfiguration gives the attacker the ability to remove the plugin from an active WordPress site, leading to loss of functionality and potential disruption of e\u2011commerce operations.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity with limited impact. An EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate on the site with Subscriber-level privileges to exploit the flaw, making it an authenticated, internal attack vector with potential for denial of service by disabling the plugin."}}}}, "created": "2025-12-08T09:39:41.299625+00:00", "updated": "2026-04-21T17:45:16.483996+00:00", "vendors": ["instantsearchplus", "instantsearchplus$PRODUCT$search,filters&merchandising_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}