CVE-2025-12582 describes a missing authorization vulnerability in the Features WordPress plugin (versions up to 0.0.2). The issue arises because the 'features_revert_option' AJAX endpoint does not perform capability checks, enabling any authenticated user with at least Subscriber privileges to revert plugin options. This improper access control can lead to unauthorized modification of plugin settings. The vulnerability is tracked as CWE-862 and has a CVSS score of 4.3, reflecting a medium impact primarily on integrity. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

An attacker with Subscriber-level access or higher can revert options in the Features plugin without proper authorization. This could lead to unauthorized changes in plugin configuration, potentially disrupting expected functionality or causing integrity issues. There is no impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to plugin option changes. Avoid granting Subscriber or higher privileges to untrusted users. No official patch or workaround has been published at this time.