Unauthorized Data Modification Vulnerability in Reuters Direct Plugin for WordPress
CVE-2025-12579

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Reuters Direct
Vendor
CVE Published:
27 November 2025

What is CVE-2025-12579?

The Reuters Direct plugin for WordPress suffers from a security flaw that allows unauthenticated users to modify plugin settings. This vulnerability arises from a lack of proper capability checks on the 'logoff' action, allowing attackers to reset settings and potentially compromise the functionality of the plugin. Users are advised to secure their installations and update to the latest versions to mitigate risks associated with this vulnerability.

Affected Version(s)

Reuters Direct * <= 3.0.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/reuters-direct/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan
JSON
.
CVE-2025-12579 : Unauthorized Data Modification Vulnerability in Reuters Direct Plugin for WordPress