CVE-2025-12809

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12809", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-06T16:12:03.255Z", "datePublished": "2025-12-16T05:25:20.504Z", "dateUpdated": "2026-04-08T16:53:00.867Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:00.867Z"}, "affected": [{"vendor": "wedevs", "product": "Dokan Pro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates."}], "title": "dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/534557b0-16d2-4a77-a118-b66fc7474ecf?source=cve"}, {"url": "https://dokan.co/wordpress/changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ahmed Rayen Ayari"}], "timeline": [{"time": "2025-10-29T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-06T16:27:25.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T16:39:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T17:29:24.180260Z", "id": "CVE-2025-12809", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T17:36:28.342Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12809", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T17:29:24.180260Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T17:35:24.200Z"}}], "cna": {"title": "dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Ahmed Rayen Ayari"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "wedevs", "product": "Dokan Pro", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.1.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-06T16:27:25.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T16:39:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/534557b0-16d2-4a77-a118-b66fc7474ecf?source=cve"}, {"url": "https://dokan.co/wordpress/changelog/"}], "descriptions": [{"lang": "en", "value": "The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-16T05:25:20.504Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12809", "state": "PUBLISHED", "dateUpdated": "2025-12-16T17:36:28.342Z", "dateReserved": "2025-11-06T16:12:03.255Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-16T05:25:20.504Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Dokan Pro", "vendor": "wedevs", "versions": [{"lessThanOrEqual": "4.1.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates."}, {"lang": "es", "value": "El plugin Dokan Pro para WordPress es vulnerable al acceso no autorizado de datos debido a una verificaci\u00f3n de capacidad faltante en el endpoint de la API REST '/dokan/v1/wholesale/register' en todas las versiones hasta la 4.1.3, inclusive. Esto hace posible que atacantes no autenticados enumeren usuarios y recuperen sus direcciones de correo electr\u00f3nico a trav\u00e9s de la API REST al proporcionar un ID de usuario, junto con otra informaci\u00f3n como nombres de usuario, nombres para mostrar, roles de usuario y fechas de registro."}], "id": "CVE-2025-12809", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12809", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-16T17:29:24.180260Z", "version": "2.0.3"}}]}, "published": "2025-12-16T06:15:41.853", "references": [{"source": "security@wordfence.com", "url": "https://dokan.co/wordpress/changelog/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/534557b0-16d2-4a77-a118-b66fc7474ecf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:10:49.562756+00:00", "value": {"mitigation_remediation": ["Upgrade the Dokan Pro plugin to version 4.1.4 or later where the vulnerability is fixed.", "Configure a web application firewall rule or plugin setting that blocks unauthenticated requests to the /dokan/v1/wholesale/register endpoint.", "After upgrading, review user data that may have been exposed and remove or obfuscate any sensitive information that could have been accessed by attackers."], "summary": {"action": "Patch", "impact": "Unauthenticated Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "All installations of the Wedevs Dokan Pro plugin for WordPress up to and including version 4.1.3 are affected. The vulnerability is present in every release through 4.1.3 and is fixed in later versions; users of these plugins should verify the version number against the changelog.", "description_and_impact": "The Dokan Pro plugin for WordPress allows unauthenticated attackers to access the REST API endpoint /dokan/v1/wholesale/register without a capability check, enabling enumeration of users and retrieval of private data such as email addresses, usernames, display names, roles, and registration dates. This flaw permits a threat actor to collect user information without needing to log in, potentially facilitating phishing, credential stuffing, or privacy breaches. The key weakness is an access control issue, classified as CWE-862.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an unauthenticated HTTP request to the vulnerable REST endpoint. An attacker can simply craft a GET or POST request that supplies a user ID, and the plugin will return the corresponding data without any authentication, making exploitation straightforward for online threat actor."}}}}, "created": "2025-12-16T20:45:26.322687+00:00", "updated": "2026-04-22T00:15:03.773674+00:00", "vendors": ["wedevs", "wedevs$PRODUCT$dokan", "wordpress", "wordpress$PRODUCT$wordpress"]}