CVE-2025-12588

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12588", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-31T22:32:12.385Z", "datePublished": "2025-11-11T03:30:41.567Z", "dateUpdated": "2026-04-08T16:59:35.248Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:35.248Z"}, "affected": [{"vendor": "behzadrohizadeh", "product": "USB Qr Code Scanner For Woocommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "title": "USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e02d105-0f1e-479e-a537-7a7fdbbd7804?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L410"}, {"url": "https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L149"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2025-11-10T15:24:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T15:36:31.233507Z", "id": "CVE-2025-12588", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:06:10.416Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T15:36:31.233507Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T15:36:44.124Z"}}], "cna": {"title": "USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "behzadrohizadeh", "product": "USB Qr Code Scanner For Woocommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:24:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e02d105-0f1e-479e-a537-7a7fdbbd7804?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L410"}, {"url": "https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L149"}], "descriptions": [{"lang": "en", "value": "The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:35.248Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12588", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:59:35.248Z", "dateReserved": "2025-10-31T22:32:12.385Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:41.567Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "USB Qr Code Scanner For Woocommerce", "vendor": "behzadrohizadeh", "versions": [{"lessThanOrEqual": "1.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin USB Qr Code Scanner For Woocommerce para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.0.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la p\u00e1gina de configuraci\u00f3n. Esto hace posible que atacantes no autenticados actualicen la configuraci\u00f3n del plugin a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12588", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12588", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T15:36:31.233507Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:47.057", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L149"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L410"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e02d105-0f1e-479e-a537-7a7fdbbd7804?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:29:50.378059+00:00", "value": {"mitigation_remediation": ["Upgrade the USB Qr Code Scanner For Woocommerce plugin to a fixed release or obtain a patch from the author that reintroduces nonce validation on the settings page.", "If an update is not yet available, disable the plugin or remove its settings page from the admin interface to prevent accidental submission of forged requests.", "Implement additional CSRF protection for WordPress or use a Web Application Firewall rule that blocks unauthorized POST requests to the plugin\u2019s settings endpoint."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Request Forgery that allows an attacker to alter the plugin\u2019s settings without authentication"}, "threat_synthesis": {"affected_systems": "Products affected are the USB Qr Code Scanner For Woocommerce plugin created by behzadrohizadeh. All released versions up to and including 1.0.0 are vulnerable; administrators using any of these releases must take action.", "description_and_impact": "The USB Qr Code Scanner For Woocommerce plugin contains missing nonce validation on its settings page. An unauthenticated attacker can craft a forged request that a logged\u2011in administrator may inadvertently submit, resulting in the plugin\u2019s configuration being changed. This modification can expose the site to policy violations, data leakage, or other unintended behaviors, although it does not directly compromise the core WordPress installation.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate risk level, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, but the attack vector relies on an advertised link or form that tricks an administrator into initiating a request. Because the CSRF flaw allows alteration of secure settings, a successful attack can impact the confidentiality and integrity of the site\u2019s configuration. Traditional defensive measures such as proper nonce checks are necessary to mitigate this risk."}}}}, "created": "2025-11-12T12:47:36.852975+00:00", "updated": "2026-04-21T18:30:27.591561+00:00", "vendors": ["behzadrohizadeh", "behzadrohizadeh$PRODUCT$usb_qr_code_scanner_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}