CVE-2025-12752

The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for unauthenticated attackers to create fake payment entries that have not actually occurred.

• CWE-345

• https://plugins.trac.wordpress.org/browser/subscriptions-memberships-for-paypal/trunk/includes/public_ipn.php
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397608%40subscriptions-memberships-for-paypal&new=3397608%40subscriptions-memberships-for-paypal&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d?source=cve

Published

Nov 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12746The Tainacan plugin for WordPress is vulnerable to Reflected…6.1
• CVE-2025-12747The Tainacan plugin for WordPress is vulnerable to Informati…5.3
• CVE-2025-12748A flaw was discovered in libvirt in the XML file processing.…5.5
• CVE-2025-1275A maliciously crafted JPG file, when linked or imported into…7.8
• CVE-2025-12750The Groundhogg — CRM, Newsletters, and Marketing Automation …4.9
• CVE-2025-12751The WSChat – WordPress Live Chat plugin for WordPress is vul…4.3
• CVE-2025-12753The Chart Expert plugin for WordPress is vulnerable to Store…6.4
• CVE-2025-12754The Geopost plugin for WordPress is vulnerable to Stored Cro…6.4
• CVE-2025-12755IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IB…4
• CVE-2025-12756Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10…4.3
• CVE-2025-12757An AXIS Camera Station Pro feature can be exploited in a way…4.6
• CVE-2025-12758Versions of the package validator before 13.15.22 are vulner…7.7