PT-2025-48130 · WordPress · Tax Service Electronic Hdm

Khaled Alenazi · Publicado 2025-11-26 · Atualizado 2025-12-01 · CVE-2025-12061

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TAX SERVICE Electronic HDM WordPress plugin versions prior to 1.2.1

Description The TAX SERVICE Electronic HDM WordPress plugin does not perform authorization and Cross-Site Request Forgery (CSRF) checks in an AJAX action. This allows unauthenticated users to import and execute arbitrary SQL statements. The issue involves a lack of security measures that should prevent unauthorized access and manipulation of the database.

Recommendations Update the TAX SERVICE Electronic HDM WordPress plugin to version 1.2.1 or later.

Exploit

Correção

Identificadores relacionados

CVE-2025-12061

Produtos afetados

Tax Service Electronic Hdm

Referências · 7

• 🔥 https://wpscan.com/vulnerability/1015dd69-faa5-4008-8884-f497ff980ed3 · Exploit
• https://twitter.com/VulmonFeeds/status/1993611805495611704 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-12061 · Nota de Segurança
• https://twitter.com/cracbot/status/1995447840496292348 · Publicação no Twitter
• https://t.me/cveNotify/144052 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1993566573664084413 · Publicação no Twitter
• https://t.me/CVEtracker/38275 · Publicação no Telegram