CVE-2025-12354: Live CSS Preview WordPress Auth Bypass

CVE-2025-12354 Overview

CVE-2025-12354 affects the Live CSS Preview plugin for WordPress. The plugin exposes the wp_ajax_frontend_save AJAX endpoint without a capability check. Authenticated users with Subscriber-level access or above can modify the plugin's CSS setting on affected sites. All versions up to and including 2.1.4 are vulnerable. The issue is classified under CWE-862: Missing Authorization.

Critical Impact
Any authenticated WordPress user with at least Subscriber privileges can overwrite the plugin's stored CSS configuration on the site.

Affected Products

WordPress Live CSS Preview plugin, all versions through 2.1.4
WordPress sites that permit user registration at Subscriber level
Any site running the plugin with default configuration

Discovery Timeline

2025-12-05 - CVE-2025-12354 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12354

Vulnerability Analysis

The Live CSS Preview plugin registers an AJAX action, wp_ajax_frontend_save, that writes to the plugin's stored CSS setting. The handler processes requests from any authenticated user because it does not verify the caller's capabilities before persisting the payload. WordPress AJAX actions registered under the wp_ajax_ prefix are accessible to every logged-in role, including Subscribers, unless the handler explicitly enforces an authorization check.

This flaw allows unauthorized modification of site data. An attacker cannot elevate to administrator directly, but they can alter presentation logic controlled by the plugin's CSS setting. Because the confidentiality and availability impacts are not affected, the vulnerability is scoped to data integrity within the plugin's configuration.

Root Cause

The root cause is a missing current_user_can() capability check in the wp_ajax_frontend_save handler. The endpoint also appears to lack a role-appropriate nonce enforcement path for privileged operations. Any authenticated session can invoke the action and pass arbitrary CSS content that the plugin writes to its options entry.

Attack Vector

Exploitation requires an authenticated account. The attacker sends a POST request to wp-admin/admin-ajax.php with the action parameter set to frontend_save and a CSS payload in the expected field. The server accepts the request, skips authorization, and updates the stored setting. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the code-level details of the missing check.

Detection Methods for CVE-2025-12354

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=frontend_save originating from Subscriber-level accounts.
Unexpected changes to the Live CSS Preview plugin option in the wp_options table.
New or modified CSS content appearing on the site without corresponding administrator activity in the audit log.

Detection Strategies

Enable WordPress audit logging for changes to plugin options and correlate with the acting user's role.
Alert on admin-ajax.php calls to frontend_save from any account below Editor.
Review web server access logs for repeated POSTs to admin-ajax.php from a single low-privilege session.

Monitoring Recommendations

Monitor the WordPress options table for unauthorized updates to the plugin's CSS setting key.
Track newly registered Subscriber accounts followed by AJAX activity within a short window.
Forward WordPress and web server logs to a centralized SIEM for correlation across user role and endpoint.

How to Mitigate CVE-2025-12354

Immediate Actions Required

Update the Live CSS Preview plugin to a version above 2.1.4 once the vendor publishes a fix.
If no patched version is available, deactivate and remove the plugin from production sites.
Disable open user registration or restrict the default role to prevent untrusted accounts from reaching the endpoint.

Patch Information

As of the CVE publication, the Live CSS Preview plugin page should be consulted for the latest release notes. Review the WordPress Plugin Changeset to confirm that the fixed release adds a current_user_can() check to the frontend_save handler.

Workarounds

Block requests to admin-ajax.php with action=frontend_save at the web application firewall for non-administrator sessions.
Restrict the Subscriber role or disable users_can_register in WordPress settings.
Apply a must-use plugin that unhooks wp_ajax_frontend_save until an official patch is installed.

bash

# Configuration example: disable open registration and lower attack surface
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate live-css-preview