PT-2025-47255 · WordPress · The Permalinks Cascade

Nabil Irawan · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-12372

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Permalinks Cascade plugin for WordPress versions up to and including 2.2

Description The Permalinks Cascade plugin for WordPress does not properly verify user authorization when performing certain actions. Specifically, the handleTPCAdminAjaxRequest function lacks sufficient checks, allowing authenticated attackers with subscriber-level access or higher to perform unauthorized administrative actions. These actions include enabling or disabling automatic pinging settings and modifying page exclusion settings.

Recommendations Update Permalinks Cascade plugin to a version later than 2.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12372

Affected Products

The Permalinks Cascade

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12372 · Security Note
• https://twitter.com/CVEnew/status/1990703890577449081 · Twitter Post
• https://plugins.trac.wordpress.org/browser/the-permalinks-cascade/tags/2.2/includes/core.class.php#L36 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c08d420d-d521-4215-9ef7-b5d1c44a19d3?source=cve · Note
• https://plugins.trac.wordpress.org/browser/the-permalinks-cascade/tags/2.2/admin/admin-controller.class.php#L109 · Note