CVE-2025-12043: WordPress Autochat Auth Bypass Vulnerability

CVE-2025-12043 Overview

CVE-2025-12043 affects the Autochat Automatic Conversation plugin for WordPress in all versions up to and including 1.1.9. The plugin exposes the wp_ajax_nopriv_auycht_saveCid AJAX endpoint without a capability check. Unauthenticated attackers can invoke this endpoint over the network to connect and disconnect the plugin's client ID. The weakness is classified as Missing Authorization [CWE-862] and impacts integrity of plugin configuration data on affected WordPress sites.

Critical Impact
Unauthenticated network attackers can modify the plugin's client ID binding, disrupting the automatic conversation integration on all sites running versions ≤ 1.1.9.

Affected Products

Autochat Automatic Conversation plugin for WordPress, versions ≤ 1.1.9
WordPress sites with the auyautochat-for-wp plugin installed and activated
All hosting environments where the vulnerable plugin is reachable over HTTP(S)

Discovery Timeline

2025-11-25 - CVE-2025-12043 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12043

Vulnerability Analysis

The plugin registers the auycht_saveCid action through the wp_ajax_nopriv_ hook. This hook is explicitly reserved in WordPress for unauthenticated visitors. The handler does not verify user capabilities and does not validate a nonce before performing state-changing operations. As a result, any remote client can issue an HTTP POST to /wp-admin/admin-ajax.php with action=auycht_saveCid and modify the stored client ID. The consequence is limited to integrity impact on plugin configuration — no confidentiality loss or service disruption is required for exploitation.

Root Cause

The root cause is a missing authorization check [CWE-862] on a sensitive AJAX endpoint. WordPress plugin developers must gate state-changing handlers with current_user_can() and check_ajax_referer(). In this plugin, the nopriv handler saves the client ID directly without either control, treating unauthenticated input as trusted configuration data.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted POST request to admin-ajax.php referencing the vulnerable action, supplying attacker-controlled parameters for the client ID. No authentication, user interaction, or elevated privileges are needed. Because no verified proof-of-concept is public and the EPSS-tracked probability remains low, opportunistic scanning is the most likely exploitation pattern.

No verified exploitation code is published. See the Wordfence Vulnerability Report for further technical details.

Detection Methods for CVE-2025-12043

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=auycht_saveCid
Unexpected changes to the Autochat plugin's stored client ID in the wp_options table
Loss of chat functionality or rerouting of chat sessions to an unfamiliar client ID

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php with the auycht_saveCid action originating from unauthenticated sessions
Audit the WordPress options table for modifications to Autochat plugin settings outside administrative change windows
Correlate WAF logs and application logs to identify repeated calls to the vulnerable endpoint from single source IPs

Monitoring Recommendations

Alert on any wp_ajax_nopriv_ handler invocation associated with configuration changes
Baseline legitimate administrative traffic to admin-ajax.php and flag deviations
Track plugin version inventory to detect installations still running Autochat ≤ 1.1.9

How to Mitigate CVE-2025-12043

Immediate Actions Required

Update the Autochat Automatic Conversation plugin to a version above 1.1.9 once released, or deactivate and remove it if no fixed version is available
Restore the correct client ID value in plugin settings after confirming no tampering occurred
Restrict access to /wp-admin/admin-ajax.php at the WAF layer for the auycht_saveCid action

Patch Information

A fixed release has not been identified in the current NVD entry. Monitor the plugin page on WordPress.org and the Wordfence advisory for patch availability. Apply the vendor update as soon as it is published.

Workarounds

Deactivate the Autochat Automatic Conversation plugin until a patched version is available
Deploy a WAF rule blocking POST requests to admin-ajax.php where the action parameter equals auycht_saveCid
Limit access to wp-admin paths by source IP where operationally feasible

bash

# Example ModSecurity rule blocking the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012043,\
    msg:'Block CVE-2025-12043 Autochat auycht_saveCid'"
    SecRule ARGS:action "@streq auycht_saveCid"