CVE-2025-12130 is a CSRF vulnerability affecting the WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress in all versions up to 2.6.4. The vulnerability is due to missing or incorrect nonce validation on the product deletion endpoint (/vendor_dashboard/product/delete/). An attacker can exploit this by tricking an authenticated site administrator into submitting a crafted request that deletes vendor products without proper authorization checks. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction and resulting in limited integrity impact without confidentiality or availability impact.

Successful exploitation allows an attacker to delete vendor products by leveraging an administrator's authenticated session through a forged request. This results in limited integrity impact on the affected system, specifically unauthorized deletion of product data. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious of unsolicited links or actions that could trigger product deletions. Implementing additional CSRF protections such as proper nonce validation or other anti-CSRF tokens on the affected endpoint is recommended once a patch or guidance is provided.