Unauthorized Data Modification in WordPress Features Plugin

CVE-2025-12582

What is CVE-2025-12582?

The Features plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to modify data without proper authorization. This occurs because the plugin lacks adequate capability checks on the 'features_revert_option' AJAX endpoint, exposing sensitive functionalities to potential misuse. Users are encouraged to update to a secure version and review their site’s user access levels to mitigate risk.

References