5.3 Medium

CVE-2025-12170 The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the…

Description

The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to, and including, 2.8.10. This makes it possible for unauthenticated attackers to clear log files.

Affected products and versions

Product	Affected versions	Fixed in
Checkbox 2.8	earliest → 2.8.10	No fix stated

Do you use Checkbox?

Track this CVE Watch Checkbox Check my SBOMs

www.cveye.io/en/cve/CVE-2025-12170

Timeline

Published November 21, 2025
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE