CVE-2025-12820
Pure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings Update
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 20, 2025
- Updated
- Apr 2, 2026
- Reserved
- Nov 6, 2025
Description
The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Pure WC Variation SwatchesUnknown |
|
References
- https://wpscan.com/vulnerability/36ccd54a-265a-44d5-b788-bc14446e3098/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.