CVE-2025-12665 is a missing authorization vulnerability (CWE-862) in the Ninja Countdown | Fastest Countdown Builder WordPress plugin by lovelightplugins. The issue arises because the AJAX endpoint 'ninja_countdown_admin_ajax' does not enforce capability checks, allowing authenticated users with minimal privileges (Subscriber and above) to delete countdowns arbitrarily. This vulnerability affects all versions up to 1.5.0. The CVSS 3.1 base score is 4.3 (medium), reflecting that the attack requires network access and low privileges but results in limited impact (integrity loss only). No patch or remediation information is currently available.

An attacker with authenticated access at Subscriber level or higher can delete arbitrary countdowns created by the plugin. This results in an integrity impact due to unauthorized modification of plugin data. There is no confidentiality or availability impact reported. The vulnerability does not allow remote unauthenticated exploitation and requires user authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only, and monitor plugin updates from lovelightplugins for a security patch addressing this issue.