PT-2025-48130 · WordPress · Tax Service Electronic Hdm

Khaled Alenazi · Published 2025-11-26 · Updated 2025-12-01 · CVE-2025-12061

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TAX SERVICE Electronic HDM WordPress plugin versions prior to 1.2.1

Description The TAX SERVICE Electronic HDM WordPress plugin does not perform authorization and Cross-Site Request Forgery (CSRF) checks in an AJAX action. This allows unauthenticated users to import and execute arbitrary SQL statements. The issue involves a lack of security measures that should prevent unauthorized access and manipulation of the database.

Recommendations Update the TAX SERVICE Electronic HDM WordPress plugin to version 1.2.1 or later.

Exploit

Fix

Related Identifiers

CVE-2025-12061

Affected Products

Tax Service Electronic Hdm

References · 7

• 🔥 https://wpscan.com/vulnerability/1015dd69-faa5-4008-8884-f497ff980ed3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12061 · Security Note
• https://twitter.com/VulmonFeeds/status/1993611805495611704 · Twitter Post
• https://twitter.com/cracbot/status/1995447840496292348 · Twitter Post
• https://t.me/cveNotify/144052 · Telegram Post
• https://twitter.com/CVEnew/status/1993566573664084413 · Twitter Post
• https://t.me/CVEtracker/38275 · Telegram Post