PT-2025-45550 · Aweber+2 · Aweber+2

Abhirup Konwar · Published 2025-11-08 · Updated 2025-11-08 · CVE-2025-12167

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contact Form 7 AWeber Extension versions through 0.1.42

Description The Contact Form 7 AWeber Extension plugin for WordPress has a flaw that allows unauthorized data modification. This is due to a missing capability check on the wp ajax aweber logreset API endpoint. Authenticated attackers with Subscriber-level access or higher can reset the AWeber logs. The wp ajax aweber logreset endpoint is the specific component affected.

Recommendations Update the Contact Form 7 AWeber Extension plugin to a version beyond 0.1.42.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12167

Affected Products

Aweber

Contact Form 7

Renzo Contact Form 7 Aweber Extension

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12167 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0f4ecda0-1eaa-44e7-8ef5-20c967b5da9f?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1987107720827171221 · Twitter Post
• https://t.me/CVEtracker/36843 · Telegram Post
• https://twitter.com/CVEnew/status/1987011691360473171 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390662%40integrate-contact-form-7-and-aweber&new=3390662%40integrate-contact-form-7-and-aweber&sfp_email=&sfph_mail= · Note