CVE-2025-12165: Webcake Landing Page Builder Auth Bypass

CVE-2025-12165 Overview

CVE-2025-12165 affects the Webcake – Landing Page Builder plugin for WordPress. The plugin exposes an authenticated endpoint that lacks a proper capability check. Attackers with Subscriber-level access can invoke the webcake_save_config AJAX action to modify plugin settings. The flaw exists in all versions of the plugin up to and including 1.1. The vulnerability maps to CWE-862: Missing Authorization and requires a valid low-privilege WordPress account to exploit.

Critical Impact
Authenticated users with Subscriber-level access or higher can modify Webcake plugin configuration through the webcake_save_config AJAX endpoint, undermining site integrity.

Affected Products

Webcake – Landing Page Builder plugin for WordPress
All versions up to and including 1.1
WordPress sites with Subscriber-level or higher user registration enabled

Discovery Timeline

2025-12-05 - CVE-2025-12165 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-12165

Vulnerability Analysis

The Webcake – Landing Page Builder plugin registers an AJAX action named webcake_save_config that persists plugin configuration data. The handler validates that the request originates from an authenticated session but does not verify that the calling user holds an administrative capability such as manage_options. Any authenticated user, including default Subscriber accounts, can therefore issue the request and alter stored plugin settings.

The impact is limited to integrity of the plugin configuration. The advisory does not identify code execution, data exfiltration, or availability effects. However, the plugin governs landing page content, so tampered configuration may influence pages presented to site visitors.

Root Cause

The root cause is a missing capability check in the AJAX handler for webcake_save_config. WordPress AJAX endpoints registered through wp_ajax_{action} are reachable by any logged-in user by default. Developers must explicitly enforce authorization using current_user_can() and validate a nonce with check_ajax_referer(). The Webcake handler omits the capability check, so the platform's default behavior allows Subscribers to reach code intended for administrators.

Attack Vector

Exploitation requires an authenticated session on the target WordPress site. An attacker registers or compromises a Subscriber account, obtains a valid nonce from an accessible admin-ajax context, and sends a POST request to /wp-admin/admin-ajax.php with action=webcake_save_config and attacker-controlled configuration parameters. The server accepts the request and updates plugin options. No user interaction from an administrator is required. Full technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Change Log.

Detection Methods for CVE-2025-12165

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=webcake_save_config originating from non-administrator user sessions.
Unexpected changes to Webcake plugin option rows in the wp_options table, particularly outside normal administrative activity windows.
Recent creation of low-privilege WordPress accounts followed by AJAX activity against the Webcake endpoint.

Detection Strategies

Enable WordPress audit logging to capture changes to plugin options and correlate the modifying user role against expected administrators.
Inspect web server access logs for admin-ajax.php requests referencing webcake_save_config and enrich with the authenticated user identifier where available.
Baseline the Webcake configuration on production sites and alert when stored option values diverge from the approved baseline.

Monitoring Recommendations

Track new user registrations against sites that expose the Webcake plugin, especially where open registration is enabled.
Alert on repeated 200-response AJAX POSTs to webcake_save_config from a single session or IP address.
Review WordPress role assignments regularly and remove unused Subscriber accounts to reduce the pool of eligible attackers.

How to Mitigate CVE-2025-12165

Immediate Actions Required

Update the Webcake – Landing Page Builder plugin to a version released after 1.1 that adds a capability check to webcake_save_config.
Disable open user registration on WordPress sites that do not require it, reducing the ability of unauthenticated actors to obtain Subscriber accounts.
Audit existing Webcake plugin settings to confirm no unauthorized modifications have been persisted.

Patch Information

The vendor addressed the missing capability check through a plugin update tracked in the WordPress Plugin Change Log. Administrators should install the latest release available on the Webcake Plugin page. Verify the installed version through the WordPress admin plugin list after the update.

Workarounds

Deactivate and remove the Webcake – Landing Page Builder plugin on sites that cannot immediately apply the vendor update.
Restrict access to /wp-admin/admin-ajax.php requests carrying action=webcake_save_config at the web application firewall for non-administrator sessions.
Downgrade or remove Subscriber-level accounts that are not required for site operation.

bash

# Example WAF rule concept: block webcake_save_config for non-admin sessions
# Pseudocode for a reverse proxy or WAF policy
if request.uri contains "/wp-admin/admin-ajax.php" \
   and request.body contains "action=webcake_save_config" \
   and session.role != "administrator":
    deny request with status 403