CVE-2025-12500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12500", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T00:33:23.959Z", "datePublished": "2026-02-19T03:25:20.170Z", "dateUpdated": "2026-04-08T17:30:27.794Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:27.794Z"}, "affected": [{"vendor": "quadlayers", "product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the \"ajax_checkout_attachment_upload\" function. This makes it possible for unauthenticated attackers to upload files to the server, though file types are limited to WordPress's default allowed MIME types (images, documents, etc.)."}], "title": "Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e807480b-00c9-4340-bd05-b695b56e27ec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L143"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3404371%40woocommerce-checkout-manager&new=3404371%40woocommerce-checkout-manager&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Burak K\u0131l\u0131n\u00e7"}], "timeline": [{"time": "2025-10-18T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-18T15:22:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:23:04.448149Z", "id": "CVE-2025-12500", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:40:18.923Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:23:04.448149Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:23:05.972Z"}}], "cna": {"title": "Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Burak K\u0131l\u0131n\u00e7"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "quadlayers", "product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.8.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-18T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-18T15:22:14.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e807480b-00c9-4340-bd05-b695b56e27ec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L143"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3404371%40woocommerce-checkout-manager&new=3404371%40woocommerce-checkout-manager&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the \"ajax_checkout_attachment_upload\" function. This makes it possible for unauthenticated attackers to upload files to the server, though file types are limited to WordPress's default allowed MIME types (images, documents, etc.)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:27.794Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12500", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:30:27.794Z", "dateReserved": "2025-10-30T00:33:23.959Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T03:25:20.170Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "vendor": "quadlayers", "versions": [{"lessThanOrEqual": "7.8.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the \"ajax_checkout_attachment_upload\" function. This makes it possible for unauthenticated attackers to upload files to the server, though file types are limited to WordPress's default allowed MIME types (images, documents, etc.)."}, {"lang": "es", "value": "El plugin Checkout Field Manager (Checkout Manager) para WooCommerce para WordPress es vulnerable a la carga de archivos limitada no autenticada en todas las versiones hasta la 7.8.1, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para realizar acciones de carga de archivos a trav\u00e9s de la funci\u00f3n 'ajax_checkout_attachment_upload'. Esto hace posible que atacantes no autenticados carguen archivos al servidor, aunque los tipos de archivo est\u00e1n limitados a los tipos MIME predeterminados permitidos por WordPress (im\u00e1genes, documentos, etc.)."}], "id": "CVE-2025-12500", "lastModified": "2026-06-17T08:32:29.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12500", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:23:04.448149Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:28.400", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L143"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L19"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-checkout-manager/tags/7.8.0/lib/class-upload.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3404371%40woocommerce-checkout-manager&new=3404371%40woocommerce-checkout-manager&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e807480b-00c9-4340-bd05-b695b56e27ec?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.8.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Checkout Field Manager (Checkout Manager) for WooCommerce", "source": "cna", "vendor": "quadlayers"}, "product": "checkout_field_manager_(checkout_manager)_for_woocommerce", "vendor": "quadlayers"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T00:10:55.509415+00:00", "value": {"mitigation_remediation": ["Update Checkout Field Manager to the latest available release, which removes the unauthenticated upload capability.", "If an immediate update is impractical, disable the plugin entirely or remove the \"ajax_checkout_attachment_upload\" action from the code base to block file uploads.", "Configure a web application firewall or use .htaccess rules to deny or monitor POST requests to the Ajax endpoint, thereby preventing unauthenticated upload attempts even if the plugin remains active."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated Limited File Upload"}, "threat_synthesis": {"affected_systems": "Any WordPress site using the Checkout Field Manager (Checkout Manager) for WooCommerce plugin by QuadLayers, on versions 7.8.1 or earlier, is affected. The vulnerability applies regardless of WooCommerce version, as long as the plugin is installed and the \"ajax_checkout_attachment_upload\" action remains active.", "description_and_impact": "The Checkout Field Manager plugin for WooCommerce allows an attacker who does not have site credentials to upload files through an Ajax endpoint named \"ajax_checkout_attachment_upload.\" The plugin fails to verify that the requester is authorized, permitting the upload of any file type that WordPress considers safe by default, such as images and certain documents. This flaw is a classic example of CWE\u2011434, where input is improperly validated. Although file types are restricted, an attacker can still place malicious assets on the server, potentially facilitating further attacks such as phishing or malicious content delivery if the files are later served or executed by vulnerable components.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation events are expected to be rare, and the plugin is not currently listed in CISA\u2019s KEV catalog. Attackers would need only HTTP access to the site\u2019s front\u2011end and could trigger the vulnerable endpoint by crafting an AJAX request, without the need for authentication or privileged access. Because the upload is limited to WordPress\u2019s default MIME types, the risk of arbitrary code execution is reduced, but the presence of uploaded files on the server can still aid in additional compromise or serve malware to site visitors."}}}}, "created": "2026-02-19T10:07:30.219616+00:00", "updated": "2026-04-21T00:15:16.129352+00:00", "vendors": ["quadlayers", "quadlayers$PRODUCT$checkout_field_manager_(checkout_manager)_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}