CVE-2025-12820 Pure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings Update
Authenticated users can modify plugin settings due to missing authorization checks in the Pure WC Variation Swatches WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12820?
CVE-2025-12820 is a medium-severity missing authorization vulnerability in Unknown Pure WC Variation Swatches, published on 20 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
Which versions are affected by CVE-2025-12820?
How do I fix CVE-2025-12820?
No fix has been published for CVE-2025-12820 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-12820 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12820 exists.
Sources
Also known as GHSA-78xx-mv96-jm4q.