CVE-2025-12130: WC Vendors WordPress Plugin CSRF Vulnerability

CVE-2025-12130 Overview

CVE-2025-12130 affects the WC Vendors WooCommerce Multivendor plugin for WordPress in all versions up to and including 2.6.4. The vulnerability stems from missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. Unauthenticated attackers can delete vendor products by tricking a site administrator into clicking a crafted link. The flaw is classified as Cross-Site Request Forgery [CWE-352].

Critical Impact
Attackers can force administrators to delete vendor products through forged requests, disrupting marketplace operations on affected WooCommerce sites.

Affected Products

WC Vendors – WooCommerce Multivendor plugin for WordPress
WooCommerce Marketplace configurations using WC Vendors
All plugin versions up to and including 2.6.4

Discovery Timeline

2025-12-05 - CVE-2025-12130 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12130

Vulnerability Analysis

CVE-2025-12130 is a Cross-Site Request Forgery (CSRF) issue in the WC Vendors plugin. The /vendor_dashboard/product/delete/ endpoint accepts product deletion requests without verifying a valid WordPress nonce. WordPress nonces exist to confirm that a state-changing request originated from an authenticated user's own browser session. Without this check, the endpoint trusts any incoming request bearing valid session cookies.

An attacker crafts a malicious page or link that triggers the delete action. When an authenticated administrator visits the attacker-controlled resource, the browser submits the deletion request using the administrator's active session. The server executes the deletion because session credentials appear legitimate.

The impact is limited to integrity of product listings. Confidentiality and availability of the broader site are not directly affected. However, marketplace operators can lose product inventory data, and repeated exploitation could disrupt vendor operations.

Root Cause

The root cause is missing nonce validation in the product controller class. The vendor product deletion handler in class-wcv-product-controller.php did not call wp_verify_nonce() or an equivalent WordPress CSRF protection function before processing deletion requests.

Attack Vector

Exploitation requires user interaction from a privileged user. The attacker hosts a page containing a hidden form or image tag that issues a request to the vulnerable endpoint. Delivery typically occurs through phishing emails, malicious comments, or compromised third-party sites. No authentication is required from the attacker, and the attack is exploitable over the network.

The vulnerability mechanism is described in the WordPress Changeset Update and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-12130

Indicators of Compromise

Unexpected POST or GET requests to /vendor_dashboard/product/delete/ originating from external Referer headers
Product deletion events in WordPress activity logs that do not correlate with legitimate administrator sessions
Missing product records reported by vendors without corresponding audit trail entries

Detection Strategies

Inspect web server access logs for requests to the vendor product delete endpoint that lack a same-origin Referer header
Enable WordPress audit logging plugins to capture deletion events with source IP and referrer metadata
Alert on high volumes of product deletion actions occurring in short time windows

Monitoring Recommendations

Monitor HTTP requests to /vendor_dashboard/product/* endpoints and flag cross-origin referrers
Track administrator session activity for anomalous state-changing actions immediately following external navigation
Correlate deletion events with recent inbound email traffic to identify phishing-driven exploitation

How to Mitigate CVE-2025-12130

Immediate Actions Required

Update the WC Vendors plugin to the version released after changeset 3408849, which adds nonce validation
Review recent product deletion activity across all vendor accounts for unauthorized removals
Restore any legitimately deleted products from backups if malicious deletion is confirmed

Patch Information

The vendor addressed the issue by adding nonce verification to the product deletion handler. See the WordPress Changeset Update for the code fix. Site administrators should upgrade to the latest available version of the WC Vendors plugin beyond 2.6.4.

Workarounds

Deploy a web application firewall (WAF) rule to block requests to /vendor_dashboard/product/delete/ that lack a same-origin Referer header
Restrict administrator browsing sessions to dedicated management workstations to reduce phishing exposure
Temporarily disable the WC Vendors plugin on sites where an immediate update is not feasible

bash

# Example WAF rule (ModSecurity) to block cross-origin deletion requests
SecRule REQUEST_URI "@contains /vendor_dashboard/product/delete/" \
  "chain,deny,status:403,id:1012130,msg:'Block CSRF on WC Vendors delete endpoint'"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example" "t:none"