CVE-2025-12961 is a missing authorization vulnerability in the Download Panel WordPress plugin by Biggiko Team. The issue arises because the `dlpn_save_settings()` function, which handles the 'wp_ajax_save_settings' AJAX action, lacks any capability verification. As a result, authenticated users with low-level privileges (Subscriber and above) can arbitrarily modify plugin settings, including UI elements and download links. This vulnerability affects all versions up to and including 1.3.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact.

An attacker with authenticated access at Subscriber level or higher can modify plugin settings without authorization. This can lead to unauthorized changes in the plugin's display text, download links, button colors, and other visual customizations. There is no direct confidentiality or availability impact reported. The integrity of the plugin's settings is affected, which could potentially be used to mislead users or alter functionality in unintended ways.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Follow the vendor's updates for any forthcoming patches or official fixes.