CVE-2025-12582: WordPress Features Plugin Auth Bypass Flaw

CVE-2025-12582 Overview

CVE-2025-12582 affects the Features plugin for WordPress in all versions up to and including 0.0.2. The plugin exposes the features_revert_option AJAX endpoint without a capability check, allowing authenticated users with Subscriber-level access or higher to revert plugin options. The flaw is classified as Missing Authorization [CWE-862] and stems from broken access control on a state-changing action. Successful exploitation results in unauthorized modification of plugin configuration data.

Critical Impact
Any authenticated user, including low-privilege Subscribers, can invoke the AJAX handler to revert plugin options and alter site configuration state.

Affected Products

WordPress Features plugin, all versions through 0.0.2
WordPress sites permitting Subscriber-level or higher registrations
Any deployment exposing the features_revert_option AJAX action

Discovery Timeline

2025-11-05 - CVE-2025-12582 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12582

Vulnerability Analysis

The Features plugin registers the features_revert_option AJAX endpoint to allow reverting plugin options to a prior state. The handler executes without verifying that the caller holds an appropriate WordPress capability. As a result, any authenticated session, including Subscriber accounts created through open registration, can invoke the action and modify plugin state. The vulnerability affects data integrity only; confidentiality and availability are not directly impacted. EPSS models score exploitation probability as low, reflecting limited functional impact and the requirement for authentication.

Root Cause

The root cause is Missing Authorization [CWE-862] on an admin-ajax.php handler. The plugin hooks the features_revert_option action via wp_ajax_ but omits a current_user_can() capability check and does not validate a nonce with check_ajax_referer(). WordPress treats any logged-in user as authorized to reach wp_ajax_ handlers unless the plugin enforces additional restrictions. Because both authentication gating and CSRF protection are absent, low-privilege roles inherit access to a privileged operation.

Attack Vector

Exploitation requires an authenticated session with Subscriber privileges or higher. The attacker sends a crafted HTTP POST request to /wp-admin/admin-ajax.php specifying the action=features_revert_option parameter along with any option identifier the handler accepts. The endpoint processes the request and reverts the targeted option without further checks. Refer to the Wordfence Vulnerability Report for additional technical context.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2025-12582

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with the parameter action=features_revert_option originating from non-administrator user sessions.
Unexpected reversion of Features plugin options in the wp_options table without a corresponding administrator action in the audit log.
Elevated request volume from Subscriber-role accounts targeting admin-ajax.php.

Detection Strategies

Correlate the action query parameter in web server logs with the authenticated user role recorded by WordPress session cookies.
Alert on any invocation of features_revert_option where the associated user lacks the manage_options capability.
Monitor wp_options write events for the Features plugin option keys and diff against a known-good baseline.

Monitoring Recommendations

Forward WordPress access logs and application audit logs to a centralized SIEM for role-based query correlation.
Track newly registered Subscriber accounts that immediately issue admin-ajax.php POST requests.
Enable a Web Application Firewall (WAF) rule set that logs unauthenticated and low-privilege access to plugin AJAX actions.

How to Mitigate CVE-2025-12582

Immediate Actions Required

Deactivate the Features plugin on any WordPress site running version 0.0.2 or earlier until a patched release is confirmed.
Disable open user registration or restrict the default role to prevent unauthenticated actors from obtaining Subscriber accounts.
Audit the wp_options table for unexpected changes to Features plugin option values and restore known-good state where needed.

Patch Information

No fixed version is identified in the NVD entry at the time of publication. Consult the WordPress Plugin Features listing for the current release status and apply any subsequent version that documents a fix for the features_revert_option handler.

Workarounds

Block requests to /wp-admin/admin-ajax.php where the action parameter equals features_revert_option and the session is not an administrator.
Restrict access to wp-admin endpoints via IP allowlisting at the reverse proxy or WAF layer.
Remove the plugin entirely if the reverted-option feature is not required for site operations.

bash

# Example WAF rule (ModSecurity) blocking low-privilege access to the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012582,msg:'Block CVE-2025-12582 Features plugin AJAX'"
    SecRule ARGS:action "@streq features_revert_option" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@ge 1"