CVE-2025-12579: Reuters Direct WordPress Auth Bypass Flaw

CVE-2025-12579 Overview

CVE-2025-12579 affects the Reuters Direct plugin for WordPress through version 3.0.0. The plugin fails to enforce a capability check on the logoff action, allowing unauthenticated attackers to reset the plugin's settings over the network. The flaw is classified under CWE-862: Missing Authorization. Successful exploitation results in unauthorized modification of plugin configuration data without any authentication or user interaction.

Critical Impact
Unauthenticated network attackers can reset the Reuters Direct plugin settings, disrupting site configuration and content integration workflows.

Affected Products

Reuters Direct plugin for WordPress, all versions up to and including 3.0.0
WordPress sites with the Reuters Direct plugin installed and activated
Any site relying on the plugin's stored settings for Reuters content delivery

Discovery Timeline

2025-11-27 - CVE-2025-12579 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12579

Vulnerability Analysis

The Reuters Direct plugin exposes a logoff action that resets plugin settings. The handler does not verify the caller's capabilities before executing the reset operation. Any unauthenticated visitor can trigger the action and revert configuration to defaults.

The integrity impact is limited to plugin settings, and confidentiality and availability of the broader WordPress installation remain intact. However, repeated resets can disrupt site functionality that depends on the plugin's configured feeds, credentials, and display options.

Root Cause

The root cause is a missing authorization check [CWE-862] on the logoff action handler. WordPress plugins are expected to gate state-changing actions with current_user_can() capability checks and check_admin_referer() or wp_verify_nonce() calls. The Reuters Direct plugin omits these controls for the logoff action, treating the request as trusted regardless of the requester's session.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP request invoking the logoff action against the plugin's admin-ajax or admin-post endpoint. Because no nonce, session, or capability verification occurs, the server processes the request and resets the plugin settings. No user interaction, credentials, or prior access are required.

No public proof-of-concept exploit has been published as of the last NVD update. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12579

Indicators of Compromise

Unexpected reset of Reuters Direct plugin configuration values in the WordPress options table
HTTP POST or GET requests to admin-ajax.php or admin-post.php containing the logoff action parameter from unauthenticated sources
Absence of a valid _wpnonce parameter accompanying logoff action requests
Sudden loss of Reuters content feeds or display anomalies following external HTTP traffic spikes

Detection Strategies

Inspect web server access logs for requests referencing action=logoff targeting the Reuters Direct plugin endpoints
Monitor the WordPress wp_options table for unscheduled changes to Reuters Direct plugin option keys
Correlate anonymous requests to plugin admin endpoints with subsequent configuration changes

Monitoring Recommendations

Enable WordPress audit logging for plugin option updates and administrative actions
Alert on requests to admin-ajax.php invoking plugin actions without an authenticated session cookie
Baseline normal Reuters Direct configuration state and alert on drift

How to Mitigate CVE-2025-12579

Immediate Actions Required

Deactivate the Reuters Direct plugin until a patched version is confirmed installed on all affected sites
Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php from untrusted networks where feasible
Back up current plugin settings so they can be restored if a reset occurs
Review web application firewall rules to block unauthenticated requests carrying the logoff action parameter

Patch Information

As of the last NVD update, the vulnerability affects all versions up to and including 3.0.0. Check the official plugin page for updated releases and apply any vendor-supplied fix that adds capability and nonce checks to the logoff action handler.

Workarounds

Deploy a WAF rule blocking requests where the action parameter equals logoff and no valid authenticated session is present
Use a WordPress security plugin to require authentication on admin-ajax endpoints for plugin-specific actions
Limit plugin usage to sites behind IP allowlisting or VPN access until a patched release is available

bash

# Example ModSecurity rule blocking unauthenticated logoff action requests
SecRule REQUEST_URI "@rx /wp-admin/admin-(ajax|post)\.php" \
    "chain,id:1012579,phase:2,deny,status:403,msg:'Block unauth Reuters Direct logoff action'"
    SecRule ARGS:action "@streq logoff" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"