CVE-2025-12639: wModes WordPress Plugin Auth Bypass Flaw

CVE-2025-12639 Overview

CVE-2025-12639 is an authorization bypass vulnerability in the wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress. The flaw affects all versions up to and including 1.2.2. The plugin fails to verify user authorization on an AJAX endpoint, allowing authenticated attackers with subscriber-level access or higher to extract sensitive site data. Exposed data includes user emails, usernames, roles, capabilities, and WooCommerce information such as products and payment methods. The weakness maps to [CWE-862] Missing Authorization.

Critical Impact
Any authenticated subscriber can enumerate user accounts and WooCommerce configuration data on affected WordPress sites.

Affected Products

wModes Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress, versions ≤ 1.2.2
WordPress sites running the vulnerable plugin with subscriber registration enabled
WooCommerce deployments integrated with the vulnerable plugin

Discovery Timeline

2025-11-18 - CVE-2025-12639 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12639

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX handler located in framework/reon/core/class.reon.core.ajax.php. The handler processes requests from authenticated users but does not enforce a capability check before returning sensitive site data. Because WordPress AJAX endpoints registered under wp_ajax_* are reachable by any logged-in account, a subscriber-level user can invoke the endpoint and receive back user records and WooCommerce data intended for administrators.

Information disclosed through the endpoint includes usernames, email addresses, assigned roles, capability sets, and store configuration such as products and payment methods. That data supports downstream attacks including credential-stuffing, targeted phishing of administrators, and reconnaissance for further exploitation of the WooCommerce environment.

Root Cause

The root cause is a missing authorization check [CWE-862]. The AJAX handler relies solely on authentication rather than validating that the calling user holds a capability appropriate for retrieving user or store data. The plugin changeset 3392651 introduces the capability check that was previously absent.

Attack Vector

Exploitation requires network access and a valid WordPress account at subscriber level or above. An attacker registers or compromises a low-privileged account, then issues an AJAX POST request to the vulnerable action on /wp-admin/admin-ajax.php. The server responds with sensitive JSON data without evaluating the caller's role. No user interaction beyond the attacker's own request is required.

See the WordPress Plugin Code Snippet and Wordfence Vulnerability Report for the vulnerable handler source and disclosure details.

Detection Methods for CVE-2025-12639

Indicators of Compromise

Unusual POST requests to /wp-admin/admin-ajax.php originating from subscriber-level accounts.
Large or repeated JSON responses returned to non-administrative sessions from the plugin's AJAX action.
Newly registered subscriber accounts followed by immediate AJAX activity against the plugin endpoint.

Detection Strategies

Review web server access logs for admin-ajax.php requests referencing plugin actions defined in class.reon.core.ajax.php.
Correlate WordPress authentication logs with AJAX request volume per user account to identify anomalous data retrieval.
Deploy a WordPress security plugin or Web Application Firewall rule that flags subscriber calls to administrative AJAX actions.

Monitoring Recommendations

Enable audit logging on user registration and role assignment events to detect adversary-created subscriber accounts.
Alert on outbound response sizes from admin-ajax.php that exceed baseline for low-privileged users.
Track installed plugin versions across managed WordPress sites and alert when versions ≤ 1.2.2 are present.

How to Mitigate CVE-2025-12639

Immediate Actions Required

Update the wModes Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin to a version above 1.2.2 that includes changeset 3392651.
Audit existing WordPress user accounts and remove unrecognized subscriber-level registrations.
Rotate credentials for any administrator or customer accounts whose emails and usernames were exposed.

Patch Information

The vendor patch is committed in the plugin repository as WordPress Plugin Changeset 3392651. The changeset adds the capability verification missing from the AJAX handler. Site operators should update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Disable open user registration in Settings > General to prevent unauthenticated attackers from obtaining a subscriber account.
Temporarily deactivate the wModes plugin until the patched version is installed.
Configure a WAF rule to block requests to the affected AJAX action from users without administrative capabilities.

bash

# Update the plugin using WP-CLI
wp plugin update catalog-mode-pricing-enquiry-forms-promotions

# Verify the installed version is above 1.2.2
wp plugin get catalog-mode-pricing-enquiry-forms-promotions --field=version

# Disable open registration as a temporary workaround
wp option update users_can_register 0