CVE-2025-12165 is a missing authorization vulnerability (CWE-862) in the Webcake – Landing Page Builder plugin for WordPress. The issue arises because the 'webcake_save_config' AJAX endpoint does not perform capability checks, enabling authenticated users with low privileges (Subscriber and above) to alter plugin configuration data. This affects all versions up to and including 1.1. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable plugin can modify the plugin's settings without proper authorization. This could lead to unauthorized changes in the plugin behavior or configuration, potentially affecting site functionality or security posture. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until then, restrict user roles to trusted individuals and consider disabling or removing the plugin if possible to reduce risk.