CVE-2025-47612: Flowdee ClickWhale Auth Bypass Flaw

CVE-2025-47612 Overview

CVE-2025-47612 is a missing authorization vulnerability in the ClickWhale WordPress plugin developed by Flowdee. The flaw stems from incorrectly configured access control security levels, allowing authenticated users with low privileges to perform actions reserved for higher-privileged roles. The issue affects all ClickWhale plugin versions up to and including 2.4.6. Authenticated attackers can exploit the weakness over the network to compromise confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with low-level privileges can bypass access controls in ClickWhale to perform restricted actions, leading to full compromise of the affected WordPress installation.

Affected Products

Flowdee ClickWhale WordPress plugin versions up to and including 2.4.6
WordPress sites with the ClickWhale link management plugin installed
All deployments running CPE cpe:2.3:a:flowdee:clickwhale:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2025-05-07 - CVE-2025-47612 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47612

Vulnerability Analysis

The ClickWhale plugin exposes functionality through WordPress action handlers and AJAX endpoints that should be restricted to administrators. The plugin fails to verify whether the requesting user holds the required capability before executing sensitive operations. Authenticated users with low privileges, such as Subscriber or Contributor roles, can invoke these handlers and modify plugin state.

The attack requires only low-privileged authentication, no user interaction, and can be conducted remotely over the network. Successful exploitation grants attackers the ability to alter link tracking data, redirect destinations, and plugin configuration. This can be leveraged for malicious redirects, phishing campaigns, or pivoting to broader site compromise.

Root Cause

The root cause is missing authorization checks [CWE-862] in privileged plugin handlers. ClickWhale relies on WordPress nonce validation or authentication state without invoking current_user_can() checks against required capabilities such as manage_options. As a result, the security model conflates authentication with authorization, granting any logged-in user access to administrative functionality.

Attack Vector

An attacker first obtains any authenticated WordPress account on a vulnerable site, including self-registered Subscriber accounts when open registration is enabled. The attacker then issues crafted HTTP requests to ClickWhale endpoints to invoke restricted actions. Because the plugin does not enforce capability checks, the requests succeed and apply the requested changes. Refer to the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2025-47612

Indicators of Compromise

Unexpected modifications to ClickWhale link entries, categories, or redirect destinations in the WordPress database
HTTP POST requests to ClickWhale admin-ajax.php actions or REST routes originating from non-administrator user sessions
Newly created or modified short links that redirect to external domains outside the organization
WordPress audit log entries showing plugin setting changes performed by Subscriber or Contributor accounts

Detection Strategies

Review web server access logs for requests to ClickWhale endpoints correlated with low-privileged session cookies
Compare current ClickWhale link table contents against known-good backups to identify unauthorized changes
Enable WordPress activity logging plugins to capture capability checks and AJAX action invocations
Monitor outbound redirects from the site for newly introduced destinations not approved by administrators

Monitoring Recommendations

Alert on creation of new WordPress accounts followed within minutes by requests to plugin administrative endpoints
Track HTTP request volume to wp-admin/admin-ajax.php with ClickWhale-specific action parameters
Monitor changes to plugin options stored in the wp_options table for unexpected writers
Forward WordPress and web server logs to a centralized analytics platform for correlation across authentication and plugin activity

How to Mitigate CVE-2025-47612

Immediate Actions Required

Update the ClickWhale plugin to a version newer than 2.4.6 as soon as a patched release is available from Flowdee
Disable the ClickWhale plugin if a fixed version is not yet installed and the functionality is not essential
Disable open WordPress user registration or restrict the default role to limit the attacker population
Audit existing ClickWhale links and configuration for unauthorized modifications and revert as needed

Patch Information

Review the Patchstack Vulnerability Report for the latest fixed version information and vendor remediation guidance. Apply the patched ClickWhale release through the WordPress plugin management interface and verify the installed version after update.

Workarounds

Deploy a web application firewall rule blocking unauthenticated and low-privileged access to ClickWhale AJAX and REST endpoints
Restrict access to wp-admin/admin-ajax.php ClickWhale actions by IP address where feasible
Remove or downgrade existing non-administrator accounts that are not required
Enforce strong password and multi-factor authentication policies to reduce account compromise risk

bash

# Configuration example: temporarily disable the ClickWhale plugin via WP-CLI
wp plugin deactivate clickwhale

# Verify deactivation status
wp plugin status clickwhale

# After patch release, update to the fixed version
wp plugin update clickwhale