CVE-2025-10212: SiteAlert WordPress Information Disclosure

CVE-2025-10212 Overview

CVE-2025-10212 affects the SiteAlert plugin for WordPress, formerly known as WP Health. The plugin fails to enforce capability checks on multiple AJAX functions through version 1.9.8. Unauthenticated attackers can query these endpoints to retrieve site health information. Exposed data includes installed plugin lists, outdated plugin versions, the PHP runtime version, and database version details. This reconnaissance data helps attackers identify additional exploitable weaknesses on the target site. The issue is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated remote attackers can enumerate site health data — including outdated plugins and PHP/database versions — enabling targeted follow-on attacks against WordPress installations running SiteAlert 1.9.8 or earlier.

Affected Products

SiteAlert (formerly WP Health) plugin for WordPress
All versions up to and including 1.9.8
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2025-10-03 - CVE-2025-10212 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10212

Vulnerability Analysis

The SiteAlert plugin registers multiple AJAX handlers that expose site health data without validating the requester's capabilities. The vulnerable handlers are located in php/ajax.php at lines 129, 144, and 159 of the 1.9.8 release. Each handler executes site diagnostic routines and returns the results to any caller that reaches the endpoint.

Because WordPress AJAX endpoints registered through wp_ajax_nopriv_* accept unauthenticated requests by default, the missing capability check allows anyone on the internet to invoke these functions. The response contains the list of installed plugins, outdated plugin identifiers, the PHP version, and the database version. Attackers use this data to select known exploits matching the identified components.

Root Cause

The root cause is Missing Authorization [CWE-862]. The AJAX callbacks omit calls to current_user_can() or equivalent capability checks before returning privileged diagnostic output. WordPress does not restrict AJAX action visibility on its own, so the plugin author must gate sensitive handlers explicitly. The 1.9.8 codebase does not perform this validation on the affected functions.

Attack Vector

The attack requires only network access to the target WordPress site. An attacker sends a crafted POST request to /wp-admin/admin-ajax.php specifying the affected action name. The server responds with the site health payload without authentication. The vulnerability affects confidentiality only — attackers cannot modify data or disrupt service through these endpoints.

See the Wordfence Vulnerability Analysis and the WordPress Code Reference for ajax.php line 129 for technical details on the unprotected handlers.

Detection Methods for CVE-2025-10212

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing SiteAlert action names originating from unknown IP addresses.
Web server logs showing repeated admin-ajax.php calls from a single source without corresponding authentication cookies.
Outbound scanning activity or exploit attempts targeting plugin versions that appear in the exposed site health data.

Detection Strategies

Review WordPress access logs for admin-ajax.php requests that lack wordpress_logged_in_* cookies and match SiteAlert AJAX action parameters.
Deploy a web application firewall rule that inspects the action parameter on admin-ajax.php and blocks unauthenticated calls to SiteAlert endpoints.
Correlate site health enumeration traffic with subsequent exploitation attempts targeting the disclosed plugin versions.

Monitoring Recommendations

Track the installed SiteAlert plugin version across the WordPress fleet and alert on any host running 1.9.8 or earlier.
Baseline normal admin-ajax.php traffic volume per site and alert on anomalous spikes from external sources.
Monitor threat intelligence feeds for exploit reports referencing the SiteAlert or WP Health plugin identifiers.

How to Mitigate CVE-2025-10212

Immediate Actions Required

Update the SiteAlert plugin to a version later than 1.9.8 on every WordPress site in the environment.
If no patched release is available, deactivate and remove the SiteAlert plugin until a fix ships.
Restrict /wp-admin/admin-ajax.php access at the perimeter to authenticated sessions where feasible.

Patch Information

A fixed version must be installed to remediate the missing capability check in php/ajax.php. Consult the Wordfence Vulnerability Analysis for the current patched release information and vendor guidance.

Workarounds

Apply a web application firewall rule to block unauthenticated requests to SiteAlert AJAX actions on admin-ajax.php.
Remove the plugin from production sites until a patched release is verified and deployed.
Rotate any credentials or secrets that may have been referenced in plugin lists exposed through the vulnerability, and prioritize patching any outdated plugins that were disclosed.

bash

# Example WAF rule concept - block unauthenticated SiteAlert AJAX actions
# Adjust action names to match the plugin's registered handlers
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1010212,msg:'Block unauth SiteAlert AJAX'"
  SecRule ARGS:action "@rx ^(wp_health|sitealert)_" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"