CVE-2025-12752CWE-345

CVE-2025-12752

Medium · published November 22, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for unauthenticated attackers to create fake payment entries that have not actually occurred.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2025-11-22T13:15Z
References (3)
https://plugins.trac.wordpress.org/browser/subscriptions-memberships-for-paypal/trunk/includes/public_ipn.php · [email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397608%40subscriptions-memberships-for-paypal&new=3397608%40subscriptions-memberships-for-paypal&sfp_email=&sfph_mail= · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d?source=cve · [email protected]
EPSS history
Timeline
  • 22 NOV 07:29Z
    Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation
    cvelistv5