CVE-2025-12681: WordPress Comment Edit Core Plugin Vulnerability

CVE-2025-12681 Overview

CVE-2025-12681 is an information disclosure vulnerability in the Comment Edit Core – Simple Comment Editing plugin for WordPress. The flaw affects all versions up to and including 3.1.0. The vulnerability resides in the ajax_get_comment function, which fails to restrict the data returned to unauthenticated requests. Attackers can retrieve sensitive commenter data including user IDs, IP addresses, and email addresses without authentication. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can harvest commenter email addresses, IP addresses, and user IDs from any WordPress site running a vulnerable version of the plugin.

Affected Products

Comment Edit Core – Simple Comment Editing WordPress plugin, versions up to and including 3.1.0
WordPress sites running the vulnerable simple-comment-editing plugin
Sites exposing the plugin's AJAX endpoint to unauthenticated visitors

Discovery Timeline

2025-11-13 - CVE-2025-12681 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12681

Vulnerability Analysis

The vulnerability exists in the ajax_get_comment handler within includes/Ajax.php of the Simple Comment Editing plugin. This AJAX endpoint returns comment metadata to clients but does not filter sensitive fields before responding. Unauthenticated requests receive the full comment record, including fields normally reserved for administrators.

An attacker sends crafted requests to the plugin's admin-ajax.php action and receives JSON responses containing personally identifiable information (PII). Exposed fields include commenter email addresses, originating IP addresses, and internal user IDs. Attackers can iterate through comment IDs to enumerate every commenter on a site.

The disclosed data enables downstream attacks such as targeted phishing, credential stuffing against exposed email accounts, and correlation of IP addresses to identify site contributors. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Analysis for additional detail.

Root Cause

The root cause is missing output filtering in the ajax_get_comment function. The handler serializes the full comment object into the AJAX response without stripping fields that should remain server-side. No capability check or field allowlist is applied before returning data to the client.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker issues HTTP requests to the plugin's AJAX endpoint with a valid comment identifier. No authentication, user interaction, or elevated privileges are required. Automated scanners can harvest data from many sites at scale.

The vulnerability mechanism involves the plugin's AJAX handler returning unfiltered comment records. Refer to the WordPress Changeset Update for the exact code changes applied in the fix.

Detection Methods for CVE-2025-12681

Indicators of Compromise

Repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with the action=sce_get_comment parameter or similar plugin-specific action
High-volume enumeration of sequential comment IDs from a single source IP
Anomalous outbound JSON payloads from the WordPress host containing email and IP fields

Detection Strategies

Inspect web server access logs for bursts of requests to admin-ajax.php targeting Simple Comment Editing actions
Deploy WordPress-aware web application firewall (WAF) rules that flag unauthenticated calls to ajax_get_comment
Correlate response sizes and content types to identify AJAX responses leaking PII fields

Monitoring Recommendations

Monitor plugin version inventory across all managed WordPress sites and alert on installations at 3.1.0 or lower
Track outbound requests to admin-ajax.php from external IPs and baseline normal comment traffic
Enable WordPress audit logging for AJAX endpoints and forward events to a centralized SIEM

How to Mitigate CVE-2025-12681

Immediate Actions Required

Update the Comment Edit Core – Simple Comment Editing plugin to the version released after changeset 3392054
Audit web server logs for prior enumeration attempts against the plugin's AJAX endpoint
Notify affected commenters if evidence of data harvesting exists

Patch Information

The vendor released a fix documented in the WordPress Changeset Update. The patch modifies the ajax_get_comment function to filter sensitive fields before returning data to unauthenticated clients. Site administrators should update through the WordPress plugin management interface or by replacing the plugin files with the patched release.

Workarounds

Deactivate and remove the Simple Comment Editing plugin until the patched version is deployed
Block unauthenticated requests to the plugin's AJAX action at the WAF or reverse proxy layer
Restrict access to admin-ajax.php for the specific sce_get_comment action to authenticated sessions only

bash

# Example WAF rule (ModSecurity) to block unauthenticated access to the vulnerable action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012681,msg:'Block CVE-2025-12681 exploit attempt'"
    SecRule ARGS:action "@streq sce_get_comment" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"