The Live CSS Preview plugin for WordPress, developed by dojodigital, suffers from a missing authorization vulnerability identified as CVE-2025-12354 (CWE-862). This vulnerability exists in all versions up to and including 2.0.0. The root cause is the absence of a proper capability check on the AJAX endpoint 'wp_ajax_frontend_save', which is responsible for saving CSS changes made via the plugin. Because of this missing authorization, any authenticated user with at least Subscriber-level privileges can invoke this endpoint to modify the plugin's CSS settings without further permission checks. This unauthorized modification capability can be exploited to alter the visual presentation of the affected WordPress site, potentially leading to defacement, misleading UI changes, or the injection of malicious CSS that could facilitate phishing or social engineering attacks. The vulnerability does not allow direct access to sensitive data (no confidentiality impact) nor does it disrupt site availability. Exploitation requires the attacker to have an authenticated account on the WordPress site but does not require any additional user interaction. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low attack complexity, and low privileges required. No patches or fixes are currently linked, and no known exploits have been reported in the wild as of the publication date. The vulnerability was reserved on 2025-10-27 and published on 2025-12-05 by Wordfence.

For European organizations, this vulnerability poses a moderate risk primarily to the integrity of their WordPress-based websites. Unauthorized CSS modifications can lead to visual defacement, brand damage, or the insertion of deceptive UI elements that could trick users into divulging credentials or other sensitive information. While the vulnerability does not directly expose confidential data or cause denial of service, the indirect consequences of UI manipulation can be significant, especially for e-commerce, government, or media websites where trust and appearance are critical. Attackers with low-level authenticated access can exploit this flaw, which increases the risk in environments where user registration is open or poorly controlled. The impact is heightened for organizations that rely heavily on WordPress plugins for site customization and have not implemented strict role-based access controls. Given the widespread use of WordPress across Europe, particularly in countries with large digital economies, the potential for exploitation exists but is somewhat mitigated by the need for authenticated access.

European organizations should immediately audit their WordPress installations to identify the presence of the Live CSS Preview plugin, especially versions up to 2.0.0. In the absence of an official patch, administrators should consider temporarily disabling the plugin or restricting access to the affected AJAX endpoint via web application firewall (WAF) rules or custom code that enforces capability checks. Review and tighten user role assignments to limit Subscriber-level accounts and ensure that only trusted users have authenticated access. Implement monitoring and alerting for unusual CSS changes or AJAX requests targeting 'wp_ajax_frontend_save'. Additionally, organizations should follow best practices by keeping all WordPress plugins updated and subscribing to vulnerability notifications from trusted sources. Once a patch is released, prioritize immediate deployment. For high-risk environments, consider isolating WordPress instances or using content security policies (CSP) to limit the impact of unauthorized CSS modifications.