CVE-2025-12961

Description

The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJAX action in all versions up to, and including, 1.3.3. This is due to the absence of any capability verification in the `dlpn_save_settings()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to arbitrarily modify plugin settings including display text, download links, button colors, and other visual customizations.

PUBLISHED Reserved 2025-11-10 | Published 2025-11-18 | Updated 2025-11-18 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Ivan Cese finder

References

www.wordfence.com/...-1a57-45b3-a4b3-cb3218782ad9?source=cve

plugins.trac.wordpress.org/...ad-panel/tags/1.3.3/plugin.php

plugins.trac.wordpress.org/...ad-panel/tags/1.3.3/plugin.php

cve.org (CVE-2025-12961)

nvd.nist.gov (CVE-2025-12961)

Download JSON