CVE-2025-12168 is a missing authorization vulnerability (CWE-862) in the Phrase TMS Integration for WordPress plugin. The issue arises because the 'wp_ajax_delete_log' AJAX endpoint does not perform capability checks, enabling any authenticated user with at least Subscriber privileges to delete log files. This affects all plugin versions up to and including 4.7.5. The vulnerability has a CVSS v3.1 base score of 4.3, reflecting a medium severity impact primarily on integrity due to unauthorized data modification. No patch or official fix has been referenced in the available data.

The vulnerability allows authenticated users with Subscriber-level access or higher to delete log files via the vulnerable AJAX endpoint. This unauthorized modification impacts data integrity but does not affect confidentiality or availability. There are no reports of exploitation in the wild. The impact is limited to the ability to remove logs, which could hinder forensic investigations or auditing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to minimize exposure and consider disabling or restricting access to the vulnerable AJAX endpoint if possible. Monitor vendor communications for updates regarding patches or official mitigations.