CVE-2025-12350 describes a missing authorization vulnerability in the DominoKit WordPress plugin by domiinodev. Specifically, the wp_ajax_nopriv_dominokit_option_admin_action AJAX endpoint lacks capability checks, enabling unauthenticated users to modify plugin settings. This affects all versions up to and including 1.1.0. The vulnerability is categorized under CWE-862 (Missing Authorization) and has a CVSS 3.1 score of 5.3, reflecting a medium severity impact primarily on integrity. No known exploits in the wild or vendor patches have been documented in the provided information.

An unauthenticated attacker can update DominoKit plugin settings via the vulnerable AJAX endpoint, potentially altering plugin behavior or configuration. The impact is limited to integrity (I:L) with no confidentiality or availability effects reported. This could lead to unauthorized changes within the plugin but does not directly disclose sensitive data or cause denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoint if possible or disable the DominoKit plugin to prevent exploitation. Monitor vendor channels for updates regarding patches or official mitigations.