CVE-2025-12820

—

CVSS 3.1

5.3 medium

EPSS

<1%p10

Published

Dec 20, 2025 (Dec 20, 2025)

Modified

Jun 17, 2026

Description

The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.

Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.