CVE-2025-12842 Overview
CVE-2025-12842 affects the Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress in versions up to and including 1.4.7. The vulnerability stems from missing validation on the tslot_appt_email AJAX action. Unauthenticated attackers can invoke this action to send appointment notification emails to arbitrary recipients with attacker-controlled content in certain email fields. The flaw is classified under [CWE-20] Improper Input Validation and allows the affected WordPress site to be abused as a relay for phishing campaigns or spam distribution.
Critical Impact
Unauthenticated remote attackers can send emails with attacker-controlled content from a vulnerable WordPress site to any recipient, enabling phishing and spam abuse that leverages the site's sender reputation.
Affected Products
- Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress, versions up to and including 1.4.7
- WordPress sites using the timeslot plugin with the tslot_appt_email AJAX action exposed
- All WordPress installations that have not applied the fix referenced in the plugin changeset
Discovery Timeline
- 2025-11-19 - CVE-2025-12842 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12842
Vulnerability Analysis
The Booking Plugin for WordPress Appointments – Time Slot plugin registers an AJAX action named tslot_appt_email that handles appointment notification emails. In versions through 1.4.7, this handler does not enforce authentication, capability checks, or nonce validation on the incoming request. It also fails to validate or sanitize key email fields before passing them to the mail-sending routine.
An unauthenticated attacker can send crafted HTTP requests to admin-ajax.php with the action=tslot_appt_email parameter and control the recipient address plus specific text fields in the email body. The site then sends the email from its own configured mail sender, giving the message the reputation of the legitimate WordPress domain. This capability is limited to the email content template used by the plugin, so full HTML injection or arbitrary header manipulation is not indicated by the advisory. The impact is primarily integrity-related — the site becomes a vehicle for phishing lures and bulk spam distribution.
Root Cause
The root cause is missing input validation and missing authorization on the tslot_appt_email AJAX endpoint. The plugin's public/form/email.php handler accepts request parameters and forwards them into email composition without verifying the caller's identity or sanitizing user-supplied text. See the WordPress Plugin Code Reference (line 21) and line 23 for the vulnerable code paths.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker issues a POST request to wp-admin/admin-ajax.php with action=tslot_appt_email and supplies a target email address along with attacker-controlled text. No authentication, user interaction, or prior reconnaissance is required. The vulnerability can be abused at scale by scripting requests against many WordPress deployments that expose the vulnerable plugin.
Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-12842
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing the parameter action=tslot_appt_email from unauthenticated sources
- Outbound SMTP traffic from the WordPress host containing appointment notification templates addressed to recipients outside the site's customer base
- Spikes in mail queue volume or bounce rates on the WordPress server's mail transport agent
- Complaints or spam reports naming the WordPress site's domain as the sending origin
Detection Strategies
- Inspect web server access logs for high-frequency requests to admin-ajax.php with the tslot_appt_email action string
- Correlate WordPress plugin version data (Time Slot ≤ 1.4.7) against inventory to identify exposed sites
- Alert on outbound mail volume anomalies from web hosts that normally send low volumes of transactional email
Monitoring Recommendations
- Enable WordPress request logging and forward admin-ajax.php events to a centralized log platform for retrospective search
- Monitor mail server logs for repeated deliveries using the appointment notification template to unrelated recipient domains
- Track EPSS and vendor advisory updates for changes in exploitation likelihood; current EPSS is 0.258%
How to Mitigate CVE-2025-12842
Immediate Actions Required
- Update the Booking Plugin for WordPress Appointments – Time Slot to a version later than 1.4.7 that includes the fix from the plugin changeset
- If an update cannot be applied immediately, deactivate the plugin until patching is possible
- Review web server and mail logs for prior abuse of the tslot_appt_email action and notify affected recipients if phishing content was sent
Patch Information
The vendor addressed the vulnerability in the plugin repository. See the WordPress Changelog Entry for the exact code changes applied to the tslot_appt_email handler. Administrators should upgrade to the fixed release published after version 1.4.7 through the WordPress plugin manager.
Workarounds
- Block unauthenticated POST requests to admin-ajax.php where action=tslot_appt_email at the web application firewall (WAF) layer
- Restrict outbound SMTP from the WordPress host to known relays and apply per-hour send-rate limits
- Temporarily disable the plugin via wp plugin deactivate timeslot until the fixed version is installed
# WP-CLI command to deactivate the vulnerable plugin
wp plugin deactivate timeslot
# Then update to the fixed release
wp plugin update timeslot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
