Cross-Site Request Forgery Vulnerability in Hide Categories Or Products On Shop Page Plugin for WordPress
CVE-2025-12128
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 December 2025
What is CVE-2025-12128?
The Hide Categories Or Products On Shop Page plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery due to inadequate nonce validation in the save_data_hcps() function. This vulnerability enables attackers to trick site administrators into submitting a forged request, potentially leading to unauthorized changes in the plugin settings when they inadvertently click a malicious link.
Affected Version(s)
Hide Categories Or Products On Shop Page * <= 1.0.7