WordPress Plugin Vulnerabilities

Comment Edit Core – Simple Comment Editing < 3.2.0 - Unauthenticated Sensitive Information Exposure

Description

The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0 via the 'ajax_get_comment' function. This makes it possible for unauthenticated attackers to extract sensitive data including user IDs, IP addresses, and email addresses.

Affects Plugins

Plugin icon
simple-comment-editing
Fixed in 3.2.0

References

CVE
CVE-2025-12681
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/4f954b02-b636-438b-a4b1-9b74df153c47

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Powpy
Verified
No
WPVDB ID
628f3542-1225-41f0-abac-e0c1a84f7a92

Timeline

Publicly Published
2025-11-12 (about 6 months ago)
Added
2025-11-12 (about 6 months ago)
Last Updated
2025-11-13 (about 6 months ago)

Other

Published
Title
Published
2024-02-26
Title
Elementor Pro < 3.19.3 - Authenticated (Contributor+) Information Exposure
Published
2024-12-10
Title
Restrict – membership, site, content and user access restrictions for WordPress < 2.2.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2024-07-15
Title
Glossary < 2.2.27 - Unauthenticated Full Path Disclosure
Published
2024-01-08
Title
Seraphinite Accelerator < 2.20.48 - Unauthenticated Sensitive Information Exposure via Log File
Published
2026-03-25
Title
Instantio < 3.3.31 - Unauthenticated Information Exposure