CVE-2025-12527: WordPress Page & Post Notes Auth Bypass

CVE-2025-12527 Overview

CVE-2025-12527 affects the Page & Post Notes plugin for WordPress. The plugin fails to enforce a capability check on the yydev_notes_save_dashboard_data function. All versions up to and including 1.3.4 are affected. Authenticated users with Subscriber-level access or higher can modify notes stored by the plugin.

The vulnerability is categorized as Missing Authorization [CWE-862]. Successful exploitation compromises the integrity of note data managed by the plugin without requiring administrative credentials.

Critical Impact
Any authenticated WordPress user, including low-privilege Subscribers, can modify notes stored by the Page & Post Notes plugin, undermining content integrity across affected sites.

Affected Products

Page & Post Notes plugin for WordPress, versions up to and including 1.3.4
WordPress installations with the plugin active
Multi-author WordPress sites that permit Subscriber or higher registration

Discovery Timeline

2025-11-07 - CVE-2025-12527 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12527

Vulnerability Analysis

The Page & Post Notes plugin exposes the yydev_notes_save_dashboard_data function to authenticated WordPress users. This function writes note data through the plugin's database insertion logic defined in include/insert-to-db.php. The handler does not verify that the calling user holds a capability appropriate for editing notes.

Because WordPress passes any authenticated request through registered AJAX or admin-post hooks, a Subscriber-level account is sufficient to reach the vulnerable code path. The plugin trusts the request context and commits the supplied note data to the database.

Root Cause

The root cause is a Missing Authorization flaw [CWE-862]. The yydev_notes_save_dashboard_data function omits a current_user_can() capability check and does not validate the acting user's role before writing to the database. Nonce validation, if present, does not substitute for authorization since Subscribers can legitimately obtain nonces from their profile pages.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privilege account. The attacker authenticates as a Subscriber, obtains any necessary nonce from an accessible admin page, and issues a request to the yydev_notes_save_dashboard_data action with attacker-controlled note payload data. The plugin persists the modification without further checks. See the WordPress Plugin Database Insert and WordPress Plugin Index File for the affected source.

Detection Methods for CVE-2025-12527

Indicators of Compromise

Unexpected modifications to note records created by the Page & Post Notes plugin, particularly changes attributed to Subscriber accounts.
POST requests to admin-ajax.php or admin-post.php referencing the yydev_notes_save_dashboard_data action from non-editor users.
Newly registered Subscriber accounts followed shortly by note write activity.

Detection Strategies

Review WordPress database audit logs for changes to plugin-managed note tables originating from users without edit_posts capability.
Inspect web server access logs for the yydev_notes_save_dashboard_data action name in query strings or POST bodies.
Correlate authentication events for low-privilege users with write operations against the plugin's endpoints.

Monitoring Recommendations

Enable a WordPress activity logging plugin that captures AJAX action names and the authenticated user role at request time.
Alert on any modification to note content performed by users below Editor role.
Baseline expected note-editing volume per role and flag deviations that could indicate abuse.

How to Mitigate CVE-2025-12527

Immediate Actions Required

Update the Page & Post Notes plugin to a version later than 1.3.4 once a patched release is confirmed by the vendor.
Audit existing Subscriber and low-privilege accounts and remove any that are not required.
Review the Wordfence Vulnerability Report for the latest fixed version guidance.

Patch Information

The plugin author's change history is tracked in the WordPress Changeset Log. Administrators should install the first release above 1.3.4 that adds a current_user_can() capability check to the yydev_notes_save_dashboard_data handler.

Workarounds

Deactivate the Page & Post Notes plugin until a fixed version is installed.
Disable new user registration or restrict registration to trusted email domains to reduce the attacker pool.
Use a web application firewall rule to block requests containing the yydev_notes_save_dashboard_data action from users without an editor-role cookie.

bash

# Disable open registration in wp-config.php or via WordPress settings
wp option update users_can_register 0

# Temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate page-post-notes