CVE-2025-12167 is a missing authorization vulnerability (CWE-862) in the rnzo Connect Contact Form 7 and AWeber WordPress plugin. The vulnerability arises because the AJAX endpoint 'wp_ajax_aweber_logreset' lacks a capability check, allowing authenticated users with low-level privileges (Subscriber and above) to reset AWeber logs. This improper access control flaw can lead to unauthorized modification of plugin data. The issue affects all versions up to 0.1.42. There is no indication of a patch or official fix available at this time.

An attacker with Subscriber-level access or higher can reset AWeber logs via the vulnerable AJAX endpoint. This impacts data integrity by allowing unauthorized modification of log data. There is no impact on confidentiality or availability reported. The vulnerability does not allow unauthenticated access or privilege escalation beyond the existing user role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted parties only and monitor for suspicious activity related to log resets. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates closely for an official fix.