{"id":"CVE-2025-12061","aliases":["EUVD-2025-199709","GHSA-jgc9-7v68-88ff"],"status":"published","title":"Tax Service Electronic HDM \u003c 1.2.1 - Unauthenticated Arbitrary SQL Execution","description":"The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0019,"percentile":0.087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352","CWE-862"],"published":"2025-11-26T06:00:08Z","modified":"2026-10-18T20:10:00Z","products":[{"vendor":"unknown","product":"tax service electronic hdm"}],"references":[{"url":"https://wpscan.com/vulnerability/1015dd69-faa5-4008-8884-f497ff980ed3/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12061"},{"url":"https://wpscan.com/vulnerability/1015dd69-faa5-4008-8884-f497ff980ed3"},{"url":"https://github.com/advisories/GHSA-jgc9-7v68-88ff"}],"sources":{"cve":[{"id":"CVE-2025-12061","title":"Tax Service Electronic HDM \u003c 1.2.1 - Unauthenticated Arbitrary SQL Execution","description":"The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements","status":"published","published":"2025-11-26T06:00:08.258Z","modified":"2026-01-09T20:10:03.37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-862","CWE-352"],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-199709","description":"The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements","status":"published","published":"2025-11-26T06:00:08Z","modified":"2026-01-09T20:10:03Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:53.623536Z"}],"ghsa":[{"id":"GHSA-jgc9-7v68-88ff","title":"The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF...","description":"The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements","status":"published","published":"2025-11-26T06:31:28Z","modified":"2026-01-09T21:31:33Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:05:33.510969Z"}],"nvd":[{"id":"CVE-2025-12061","description":"The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements","status":"published","published":"2025-11-26T06:15:44.223Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-352","CWE-862"],"updated_at":"2026-11-02T14:11:46.94029Z"}]}}