VulnerabilityDeferred

CVE-2025-12061

The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements

HIGH 8.6EPSS 0.18%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements

CVSS 3.1: 8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.18% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-352, CWE-862
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/1015dd69-faa5-4008-8884-f497ff980ed3/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.