CVE-2025-12579 describes a missing authorization vulnerability in the Reuters Direct WordPress plugin (rnags) affecting all versions up to 3.0.0. Specifically, the 'logoff' action lacks proper capability checks, enabling unauthenticated users to modify plugin settings by resetting them. This vulnerability is categorized under CWE-862, which concerns missing authorization controls. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or vendor advisory is currently available to confirm remediation status.

An unauthenticated attacker can reset the Reuters Direct plugin's settings, potentially disrupting its intended configuration or operation. The integrity of the plugin's data can be compromised, but there is no direct impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's actions or disabling the plugin if feasible to prevent unauthorized resets. Monitor vendor channels for updates regarding patches or official mitigations.