{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12527", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T17:21:17.863Z", "datePublished": "2025-11-07T05:29:58.432Z", "dateUpdated": "2026-04-08T17:09:46.076Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:46.076Z"}, "affected": [{"vendor": "yydevelopment", "product": "Page & Post Notes", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes."}], "title": "Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93dadc33-cabf-4701-97ca-861ad90597fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/index.php#L85"}, {"url": "https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/include/insert-to-db.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389236%40page-post-notes&new=3389236%40page-post-notes&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-03T21:24:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-06T17:14:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-07T13:21:00.378906Z", "id": "CVE-2025-12527", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-07T13:22:13.626Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12527", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-07T13:21:00.378906Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-07T13:22:08.966Z"}}], "cna": {"title": "Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "yydevelopment", "product": "Page & Post Notes", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T21:24:49.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-06T17:14:46.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93dadc33-cabf-4701-97ca-861ad90597fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/index.php#L85"}, {"url": "https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/include/insert-to-db.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389236%40page-post-notes&new=3389236%40page-post-notes&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-07T05:29:58.432Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12527", "state": "PUBLISHED", "dateUpdated": "2025-11-07T13:22:13.626Z", "dateReserved": "2025-10-30T17:21:17.863Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-07T05:29:58.432Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes."}], "id": "CVE-2025-12527", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-07T06:15:33.283", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/include/insert-to-db.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/index.php#L85"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389236%40page-post-notes&new=3389236%40page-post-notes&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93dadc33-cabf-4701-97ca-861ad90597fb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:37:11.722050+00:00", "value": {"mitigation_remediation": ["Upgrade Page & Post Notes to any version newer than 1.3.4 that includes the missing capability check.", "Restrict edit rights for Subscriber and lower roles by removing the custom capability used by the plugin (yydev_notes_save_dashboard_data), ensuring only Administrators can perform note modifications.", "Monitor site logs for attempts to modify notes and verify that unauthorized edit attempts are blocked by the applied restrictions."], "summary": {"action": "Patch", "impact": "Unauthorized modification of notes by authenticated users"}, "threat_synthesis": {"affected_systems": "The affected system is the Page & Post Notes WordPress plugin developed by yydevelopment. All releases up to and including version 1.3.4 are vulnerable; site administrators should verify the installed plugin version.", "description_and_impact": "The Page & Post Notes plugin contains a missing capability check on the 'yydev_notes_save_dashboard_data' function in all releases up to 1.3.4. Authenticated users with Subscriber-level access or higher can exploit this flaw to modify or delete notes stored by the plugin. The change of note content can alter information presented to site visitors, compromising content integrity.", "risk_and_exploitability": "The CVSS score of 4.3 indicates medium severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated, with at least Subscriber privileges, to exploit the flaw by invoking the backend endpoint that processes note updates or deletions."}}}}, "created": "2025-11-07T10:53:34.419751+00:00", "updated": "2026-04-22T00:45:04.156766+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}