CVE-2025-12015 is a missing authorization vulnerability in the Convert WebP & AVIF | Quicq WordPress plugin. The issue exists because the AJAX endpoint 'wp_ajax_wpqai_disconnect_quicq_afosto' lacks a capability check, enabling authenticated users with minimal privileges (Subscriber and above) to perform unauthorized actions, specifically disconnecting Afosto integration. This vulnerability affects all plugin versions up to and including 2.0.0. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily on integrity. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker with at least Subscriber-level access can exploit this vulnerability to disconnect Afosto integration via the vulnerable AJAX endpoint without proper authorization. This results in unauthorized modification of plugin data or configuration, impacting the integrity of the affected system. There is no confidentiality or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized changes related to Afosto disconnection. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates closely for any released patches or official mitigations.