CVE-2025-12586

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12586", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-31T22:24:37.442Z", "datePublished": "2025-11-25T07:28:20.635Z", "dateUpdated": "2026-04-08T16:53:04.028Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:04.028Z"}, "affected": [{"vendor": "evolurise", "product": "Conditionnal Maintenance Mode for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to enable or disable the site's maintenance mode via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "title": "Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535f1d8a-8266-4f90-82fa-9c32181bf277?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/maintenance-mode-based-on-user-roles/tags/1.0.0/Maintenance_mode.php#L178"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3403376%40maintenance-mode-based-on-user-roles&new=3403376%40maintenance-mode-based-on-user-roles&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-11-26T15:38:04.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-24T19:14:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T15:05:20.767749Z", "id": "CVE-2025-12586", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T15:05:26.995Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12586", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-25T15:05:20.767749Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T15:05:23.666Z"}}], "cna": {"title": "Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}}], "affected": [{"vendor": "evolurise", "product": "Conditionnal Maintenance Mode for WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-24T19:14:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535f1d8a-8266-4f90-82fa-9c32181bf277?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/maintenance-mode-based-on-user-roles/tags/1.0.0/Maintenance_mode.php#L178"}], "descriptions": [{"lang": "en", "value": "The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to enable or disable the site's maintenance mode via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-25T07:28:20.635Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12586", "state": "PUBLISHED", "dateUpdated": "2025-11-25T15:05:26.995Z", "dateReserved": "2025-10-31T22:24:37.442Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-25T07:28:20.635Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Conditionnal Maintenance Mode for WordPress", "vendor": "evolurise", "versions": [{"lessThanOrEqual": "1.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to enable or disable the site's maintenance mode via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Conditional Maintenance Mode for WordPress para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 1.0.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce al alternar el estado del modo de mantenimiento. Esto hace posible que atacantes no autenticados habiliten o deshabiliten el modo de mantenimiento del sitio a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12586", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12586", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T15:05:20.767749Z", "version": "2.0.3"}}]}, "published": "2025-11-25T08:15:48.707", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/maintenance-mode-based-on-user-roles/tags/1.0.0/Maintenance_mode.php#L178"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3403376%40maintenance-mode-based-on-user-roles&new=3403376%40maintenance-mode-based-on-user-roles&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/535f1d8a-8266-4f90-82fa-9c32181bf277?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:00:11.239365+00:00", "value": {"mitigation_remediation": ["Upgrade the Conditional Maintenance Mode plugin to the latest available release (any version newer than 1.0.0) which includes proper nonce validation for mode toggling.", "If no newer release is available, remove or deactivate the plugin until a fix is released to eliminate the CSRF vector.", "Consider disabling unintended maintenance mode changes by configuring site\u2011wide maintenance activity manually in WordPress settings and limiting administrator access to trusted users only."], "summary": {"action": "Update plugin", "impact": "Cross\u2011Site Request Forgery that allows an attacker to toggle maintenance mode"}, "threat_synthesis": {"affected_systems": "The plugin by Evolurise, named Conditional Maintenance Mode for WordPress, is affected in all releases up to and including version 1.0.0. Any WordPress installation that has installed or activated this plugin within those versions is at risk.", "description_and_impact": "The vulnerability resides in the Conditional Maintenance Mode for WordPress plugin, where a missing nonce check permits an unauthenticated attacker to craft a request that flips the site\u2019s maintenance status. An attacker must sidestep the normal WordPress authentication flow \u2013 typically by enticing an administrator to click a malicious link \u2013 but once a forged request is sent the plugin will enable or disable maintenance mode without any further verification. The impact is limited to configuration changes that can deny legitimate traffic or expose the site under maintenance, but it does not directly lead to code execution or data theft.", "risk_and_exploitability": "The CVSS score is 4.3, indicating a low\u2011to\u2011moderate severity, and the EPSS score is reported as < 1%, showing an extremely low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires only the ability to persuade an administrative user to click a link, making the attack vector a social\u2011engineering web request that bypasses nonce protection. Once the designed request is delivered, the plugin will alter the maintenance mode state unconditionally."}}}}, "created": "2025-12-01T15:19:25.162824+00:00", "updated": "2026-04-21T18:00:11.750793+00:00", "vendors": ["evolurise", "evolurise$PRODUCT$conditional_maintenance_mode_for_wordpress", "wordpress", "wordpress$PRODUCT$wordpress"]}