CVE-2025-12350: DominoKit WordPress Auth Bypass Flaw

CVE-2025-12350 Overview

CVE-2025-12350 affects the DominoKit plugin for WordPress in all versions up to and including 1.1.0. The plugin exposes the wp_ajax_nopriv_dominokit_option_admin_action AJAX endpoint without a capability check. Unauthenticated attackers can send crafted requests to this endpoint and modify plugin settings. The flaw is classified as Missing Authorization [CWE-862] and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated attackers can update DominoKit plugin settings on affected WordPress sites, altering plugin behavior without any credentials.

Affected Products

DominoKit plugin for WordPress, all versions through 1.1.0
WordPress sites with the DominoKit plugin installed and activated
Any hosting environment exposing the vulnerable AJAX endpoint to the internet

Discovery Timeline

2025-11-04 - CVE-2025-12350 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12350

Vulnerability Analysis

The DominoKit plugin registers an administrative action handler through the WordPress wp_ajax_nopriv_ hook prefix. This hook prefix explicitly exposes the endpoint to unauthenticated visitors. The handler dominokit_option_admin_action processes requests that modify plugin configuration but does not verify the caller's capability or validate a nonce.

An attacker can issue an HTTP POST request to /wp-admin/admin-ajax.php with the action parameter set to dominokit_option_admin_action. The plugin processes the request and updates settings as if it came from an administrator. This affects the integrity of the plugin configuration while leaving confidentiality and availability unaffected, consistent with the reported impact metrics.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. The plugin registers a privileged settings-update routine on the wp_ajax_nopriv_ action, which by design accepts requests from users without an authenticated session. The handler lacks a current_user_can() check and does not verify a nonce via check_ajax_referer(). Sensitive administrative logic executes on behalf of any anonymous client.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends a single unauthenticated POST request to the admin-ajax endpoint with parameters targeting the vulnerable action name. No user interaction, prior authentication, or elevated privileges are needed. Refer to the Wordfence Vulnerability Report for additional technical context.

No verified public exploit code is available. The vulnerability is described in prose because no realCodeExamples were provided.

Detection Methods for CVE-2025-12350

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=dominokit_option_admin_action
Unexpected changes to DominoKit plugin option values in the wp_options table
Requests to admin-ajax.php originating from unfamiliar IP addresses or without a valid session cookie

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php referencing the dominokit_option_admin_action action name.
Correlate WordPress database change events on DominoKit-related option rows with the source IP of admin-ajax requests.
Alert on any request to a wp_ajax_nopriv_ handler that immediately precedes a plugin settings change.

Monitoring Recommendations

Enable WordPress audit logging to capture option updates and the user context that triggered them.
Forward web server and WordPress logs to a centralized SIEM for retention and correlation.
Track the installed DominoKit plugin version across the site inventory to identify unpatched instances.

How to Mitigate CVE-2025-12350

Immediate Actions Required

Update the DominoKit plugin to a version later than 1.1.0 as soon as the vendor publishes a fix.
If no patched version is available, deactivate and remove the DominoKit plugin from all WordPress sites.
Review current DominoKit plugin settings for unauthorized modifications and restore known-good values.

Patch Information

At the time of publication, the enriched data does not list a fixed version. Monitor the DominoKit plugin page on WordPress.org and the Wordfence Vulnerability Report for updated release information.

Workarounds

Block unauthenticated POST requests to admin-ajax.php with action=dominokit_option_admin_action at the web application firewall (WAF).
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible, while preserving legitimate front-end AJAX functionality.
Disable the DominoKit plugin until a patched version is installed.

bash

# Example WAF rule concept (ModSecurity)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012350,msg:'Block DominoKit CVE-2025-12350'"
  SecRule ARGS:action "@streq dominokit_option_admin_action" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"