PT-2025-45065 · WordPress · Features

Nabil Irawan · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-12582

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Features plugin for WordPress versions up to and including 0.0.2

Description The Features plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the features revert option API endpoint. Authenticated attackers with Subscriber-level access or higher can revert options.

Recommendations Update the Features plugin to a version later than 0.0.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12582

Affected Products

Features

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12582 · Security Note
• https://wordpress.org/plugins/features · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4a6efab8-04a0-459f-a791-9360c83e5dbe?source=cve · Note
• https://t.me/CVEtracker/36576 · Telegram Post
• https://t.me/cveNotify/141759 · Telegram Post