CVE-2025-12583 affects the Simple Downloads List plugin for WordPress by lacking proper capability checks on AJAX endpoints such as 'wp_ajax_neofix_sdl_edit'. This missing authorization allows authenticated users with low privileges (Subscriber and above) to alter plugin data and inject malicious web scripts. The vulnerability impacts all versions up to and including 1.4.3. The CVSS 3.1 score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and privileges required at the level of an authenticated user. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with Subscriber-level WordPress access or higher can exploit this vulnerability to modify plugin settings and downloads, potentially injecting malicious scripts. This can lead to partial compromise of the affected WordPress site’s functionality and integrity of plugin data. The impact includes limited confidentiality and integrity loss but no availability impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to the Simple Downloads List plugin. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates closely for an official fix.