CVE-2025-12752

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12752", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-05T15:10:49.804Z", "datePublished": "2025-11-22T07:29:19.967Z", "dateUpdated": "2026-04-08T17:06:34.428Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:34.428Z"}, "affected": [{"vendor": "scottpaterson", "product": "Subscriptions & Memberships for PayPal", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for unauthenticated attackers to create fake payment entries that have not actually occurred."}], "title": "Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/subscriptions-memberships-for-paypal/trunk/includes/public_ipn.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397608%40subscriptions-memberships-for-paypal&new=3397608%40subscriptions-memberships-for-paypal&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-345 Insufficient Verification of Data Authenticity", "cweId": "CWE-345", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-11-05T15:25:57.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-21T18:49:09.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T19:32:37.155323Z", "id": "CVE-2025-12752", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T19:32:47.365Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12752", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T19:32:37.155323Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T19:32:42.517Z"}}], "cna": {"title": "Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "scottpaterson", "product": "Subscriptions & Memberships for PayPal", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-05T15:25:57.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-21T18:49:09.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/subscriptions-memberships-for-paypal/trunk/includes/public_ipn.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397608%40subscriptions-memberships-for-paypal&new=3397608%40subscriptions-memberships-for-paypal&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for unauthenticated attackers to create fake payment entries that have not actually occurred."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:34.428Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12752", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:34.428Z", "dateReserved": "2025-11-05T15:10:49.804Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-22T07:29:19.967Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Subscriptions & Memberships for PayPal", "vendor": "scottpaterson", "versions": [{"lessThanOrEqual": "1.1.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for unauthenticated attackers to create fake payment entries that have not actually occurred."}, {"lang": "es", "value": "El plugin Subscriptions & Memberships for PayPal para WordPress es vulnerable a la creaci\u00f3n de pagos falsos en todas las versiones hasta la 1.1.7, inclusive. Esto se debe a que el plugin no verifica correctamente la autenticidad de una solicitud IPN. Esto permite a atacantes no autenticados crear entradas de pago falsas que en realidad no han ocurrido."}], "id": "CVE-2025-12752", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12752", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T19:32:37.155323Z", "version": "2.0.3"}}]}, "published": "2025-11-22T08:15:42.953", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/subscriptions-memberships-for-paypal/trunk/includes/public_ipn.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397608%40subscriptions-memberships-for-paypal&new=3397608%40subscriptions-memberships-for-paypal&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:28:29.102013+00:00", "value": {"mitigation_remediation": ["Upgrade the Subscriptions & Memberships for PayPal plugin to the latest available version.", "If an upgrade is not immediately possible, temporarily disable the plugin while protecting the site\u2019s money\u2011handling features.", "Configure the plugin or the server so that IPN requests are only accepted from verified PayPal endpoints, ensuring that each payment notification is validated against PayPal before creating records."], "summary": {"action": "Patch", "impact": "Unauthorized Payment Creation"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin Subscriptions & Memberships for PayPal, developed by scottpaterson, in all releases up to and including version 1.1.7.", "description_and_impact": "This vulnerability allows an attacker who can send a crafted IPN request to the Subscriptions & Memberships for PayPal plugin to create payout records that never occurred, effectively allowing unauthorized creations of payment entries. The flaw stems from a failure to validate the authenticity of IPN notifications, which means the plugin does not verify that the request actually came from PayPal. This weakness is classified as CWE\u2011345, representing insufficient verification of source integrity.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a malicious IPN POST request directly to the plugin\u2019s public endpoint without needing authentication. Successful exploitation could result in fake payment entries that do not reflect real transactions, potentially affecting the site\u2019s financial logs."}}}}, "created": "2025-11-24T09:08:23.622681+00:00", "updated": "2026-04-22T00:30:04.056546+00:00", "vendors": ["scottpaterson", "scottpaterson$PRODUCT$subscriptions_&_memberships_for_paypal", "wordpress", "wordpress$PRODUCT$wordpress"]}