{"id":"CVE-2025-12639","aliases":["EUVD-2025-197961","GHSA-6fcx-4fmq-2fx7"],"status":"published","title":"wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions | for WooCommerce \u003c= 1.2.2 - Missing Authorization to Sensitive Information Disclosure","description":"The wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00273,"percentile":0.19866,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-11-18T09:27:39Z","modified":"2026-10-18T20:10:00Z","products":[{"vendor":"sundayfanz","product":"wmodes – catalog mode, product pricing, enquiry forms \u0026 promotions | for woocommerce"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979001c4-45dd-4168-8749-c8eebe237b60?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/catalog-mode-pricing-enquiry-forms-promotions/tags/1.2.1/framework/reon/core/class.reon.core.ajax.php#L12"},{"url":"https://plugins.trac.wordpress.org/browser/catalog-mode-pricing-enquiry-forms-promotions/tags/1.2.1/framework/reon/core/class.reon.core.ajax.php#L29"},{"url":"https://plugins.trac.wordpress.org/browser/catalog-mode-pricing-enquiry-forms-promotions/tags/1.2.1/framework/reon/core/class.reon.core.ajax.php#L165"},{"url":"https://plugins.trac.wordpress.org/changeset/3392651/catalog-mode-pricing-enquiry-forms-promotions/trunk?contextall=1\u0026old=3390779\u0026old_path=%2Fcatalog-mode-pricing-enquiry-forms-promotions%2Ftrunk#file11"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12639"},{"url":"https://github.com/advisories/GHSA-6fcx-4fmq-2fx7"}],"sources":{"cve":[{"id":"CVE-2025-12639","title":"wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions | for WooCommerce \u003c= 1.2.2 - Missing Authorization to Sensitive Information Disclosure","description":"The wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.","status":"published","published":"2025-11-18T09:27:39.489Z","modified":"2026-04-08T17:10:28.087Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-197961","description":"The wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.","status":"published","published":"2025-11-18T09:27:39Z","modified":"2026-04-08T17:10:28Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:48.525699Z"}],"ghsa":[{"id":"GHSA-6fcx-4fmq-2fx7","title":"The wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions plugin for WordPress is...","description":"The wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.","status":"published","published":"2025-11-18T12:30:18Z","modified":"2025-11-18T12:30:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:04:50.769565Z"}],"nvd":[{"id":"CVE-2025-12639","description":"The wModes – Catalog Mode, Product Pricing, Enquiry Forms \u0026 Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.","status":"published","published":"2025-11-18T10:15:48.137Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:44.669367Z"}]}}