CVE-2025-12170: WordPress Checkbox Auth Bypass Vulnerability

CVE-2025-12170 Overview

The Checkbox plugin for WordPress contains a missing authorization vulnerability [CWE-862] affecting all versions up to and including 2.8.10. The flaw resides in the wp_ajax_nopriv_checkbox_clean_log AJAX endpoint, which lacks a capability check. Unauthenticated attackers can invoke this endpoint over the network to clear plugin log files. The issue does not expose data confidentiality or availability of the site, but it does allow tampering with logging integrity. Clearing logs can hinder forensic investigations and mask prior malicious activity on affected WordPress installations.

Critical Impact
Unauthenticated attackers can remotely clear Checkbox plugin log files, potentially destroying evidence of prior activity on the site.

Affected Products

Checkbox plugin for WordPress, all versions through 2.8.10
WordPress sites running the vulnerable plugin with the AJAX endpoint reachable
Any environment relying on Checkbox plugin logs for auditing

Discovery Timeline

2025-11-21 - CVE-2025-12170 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12170

Vulnerability Analysis

The vulnerability is a missing authorization flaw in the Checkbox WordPress plugin. The plugin registers a log-clearing action through the wp_ajax_nopriv_checkbox_clean_log hook. WordPress uses the nopriv variant of wp_ajax_* actions to expose endpoints to unauthenticated visitors. Because the handler does not validate the caller's capability or verify a nonce, any anonymous request to /wp-admin/admin-ajax.php with the corresponding action parameter triggers log deletion. The impact is limited to integrity of plugin log data, which aligns with the reported low-integrity impact. However, in incident response workflows, log erasure can obstruct root-cause analysis and complicate detection of preceding exploitation attempts.

Root Cause

The root cause is the absence of a capability check and nonce verification inside the AJAX handler bound to wp_ajax_nopriv_checkbox_clean_log. Registering the destructive action through the nopriv hook exposes it to unauthenticated users. The handler should have been restricted to authenticated administrators using current_user_can() and check_ajax_referer().

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a single HTTP POST request to admin-ajax.php specifying the vulnerable action. No authentication, no user interaction, and no elevated privileges are required. The attacker does not need any prior foothold on the target site. See the Wordfence Vulnerability Report and the WordPress Changeset Update for handler-level details.

No verified public exploit code is available; the vulnerability is described in prose based on the referenced advisories.

Detection Methods for CVE-2025-12170

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the parameter action=checkbox_clean_log
Sudden truncation or emptying of Checkbox plugin log files without administrator activity
Requests to admin-ajax.php from unauthenticated sessions with no valid wordpress_logged_in_* cookie
Repeated log-clear requests from a single IP or user-agent shortly after other suspicious plugin activity

Detection Strategies

Inspect web server access logs for admin-ajax.php calls invoking checkbox_clean_log and correlate against authenticated administrator sessions
Enable file integrity monitoring on Checkbox plugin log paths to detect unexpected clearing
Alert on anonymous access to wp_ajax_nopriv_* actions that perform destructive operations

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM for correlation and long-term retention
Retain log copies off-host so that in-place deletion by the plugin does not eliminate forensic evidence
Baseline normal administrative activity to identify anomalous log-management events

How to Mitigate CVE-2025-12170

Immediate Actions Required

Update the Checkbox plugin to a version above 2.8.10 once the vendor patch is applied on the WordPress plugin repository
Audit Checkbox log files for unexplained clearing prior to patching
Restrict access to /wp-admin/admin-ajax.php at the WAF or reverse proxy layer for the checkbox_clean_log action

Patch Information

The vendor addressed the missing capability check in the plugin repository. Review the WordPress Changeset Update for the code change and upgrade all affected sites to the fixed release.

Workarounds

Deactivate and remove the Checkbox plugin until an upgrade is applied
Add a WAF rule that blocks unauthenticated POST requests where action=checkbox_clean_log
Restrict admin-ajax.php access to known administrative IP ranges where operationally feasible

bash

# Example WAF/ModSecurity rule to block unauthenticated calls to the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012170,msg:'Block CVE-2025-12170 checkbox_clean_log'"
  SecRule ARGS:action "@streq checkbox_clean_log" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"