Medium severity5.3NVD Advisory· Published Dec 6, 2025· Updated Apr 15, 2026

CVE-2025-12720

Description

The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to delete arbitrary products.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

g-FFL/g-FFL Cockpitllm-create
Range: <=1.7.1
WordPress/G Ffl Cockpitwp-canonicalize
Package: https://wordpress.org/plugins/g-ffl-cockpit

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/g-ffl-cockpit/trunk/includes/class-update-processor.phpnvd
plugins.trac.wordpress.org/changeset/3413768/nvd
ryankozak.com/posts/cve-2025-12720/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/3405974d-cf0a-4fef-9693-5d81833f42d6nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000