WordPress Plugin Vulnerabilities

Page & Post Notes < 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion

Description

The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes.

Affects Plugins

Plugin icon
page-post-notes
Fixed in 1.3.5

References

CVE
CVE-2025-12527
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/93dadc33-cabf-4701-97ca-861ad90597fb

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Athiwat Tiprasaharn (Jitlada)
Verified
No
WPVDB ID
22532fd6-2c87-4cd7-9da4-7d5755bad54f

Timeline

Publicly Published
2025-11-06 (about 9 months ago)
Added
2025-11-06 (about 9 months ago)
Last Updated
2025-11-07 (about 9 months ago)

Other

Published
Title
Published
2024-09-30
Title
Popup Maker < 1.20.0 - Missing Authorization
Published
2026-03-26
Title
Smart Slider 3 < 3.5.1.34 - Subscriber+ Arbitrary File Read via actionExportAll
Published
2026-07-22
Title
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages < 3.3.6 - Missing Authorization
Published
2025-06-26
Title
VG WORT METIS <= 2.0.1 - Missing Authorization
Published
2025-02-27
Title
NextMove Lite – Thank You Page for WooCommerce < 2.20.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission