CVE-2025-12720

MediumCVSS 5.3

Published: 06/12/2025(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The g-FFL Cockpit plugin for WordPress (versions up to and including 1.7.1) is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function. Unauthenticated attackers can delete arbitrary products.

Risk Assessment

An attacker can delete products without authentication, potentially causing financial loss and disruption to the store's operations.

Recommendation

Update the g-FFL Cockpit plugin to the latest version. Do not rely on IP-based authorization; implement proper authentication and authorization mechanisms.

Other vulnerabilities in g-FFL Cockpit

CVE-2025-12721Medium
The g-FFL Cockpit plugin for WordPress (versions up to and including 1.7.1) is vulnerable to Sensitive Information Exposure via the /server_status REST API endpoint due to a lack of capability checks. Unauthenticated attackers can extract information about the server.

Original NVD description (English source)

The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to delete arbitrary products.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS