Overview
CVE-2025-12170 is a medium severity vulnerability discovered in the Checkbox plugin for WordPress. This vulnerability allows unauthenticated attackers to clear log files due to a missing capability check on the wp_ajax_nopriv_checkbox_clean_log AJAX endpoint. This affects all versions of the plugin up to and including 2.8.10.
Technical Details
The vulnerability exists because the wp_ajax_nopriv_checkbox_clean_log AJAX endpoint lacks proper authentication and authorization checks. Specifically, it does not verify if the user making the request has the necessary capabilities to clear the plugin’s log files. This allows anyone, even unauthenticated users, to trigger this function by sending a crafted AJAX request. The consequence of this is arbitrary log deletion, potentially hindering auditing and forensic analysis.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) score for CVE-2025-12170 is 5.3 (Medium).
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality Impact (C): None (N)
- Integrity Impact (I): Low (L)
- Availability Impact (A): None (N)
The medium severity is primarily driven by the low attack complexity and lack of required privileges, allowing remote attackers to trigger the vulnerability without user interaction.
Possible Impact
Successful exploitation of this vulnerability can lead to the following:
- Log Tampering: Unauthenticated attackers can clear log files, potentially masking malicious activity and hindering security investigations.
- Denial of Service (Indirect): While not a direct DoS, the removal of logs can make it difficult to troubleshoot issues, potentially leading to service disruptions.
- Reduced Visibility: Clearing logs reduces the administrator’s ability to monitor plugin activity and identify potential security threats.
Mitigation and Patch Steps
The recommended mitigation is to update the Checkbox plugin to the latest version. Specifically, ensure you are running a version greater than 2.8.10, where the vulnerability has been patched. Follow these steps:
- Log in to your WordPress admin dashboard.
- Navigate to the “Plugins” section.
- Locate the “Checkbox” plugin.
- If an update is available, click the “Update Now” button.
- Verify the update was successful and the plugin version is greater than 2.8.10.
If an update is not immediately available, consider temporarily disabling the plugin until a patched version is released.
