CVE-2025-12168
📋 TL;DR
The Phrase TMS Integration for WordPress plugin has an authorization vulnerability that allows authenticated users with Subscriber-level access or higher to delete log files via the 'wp_ajax_delete_log' AJAX endpoint. This affects all WordPress sites using plugin versions up to and including 4.7.5.
💻 Affected Systems
- Phrase TMS Integration for WordPress
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete audit logs to cover tracks after other attacks, potentially enabling undetected persistence or data exfiltration.
Likely Case
Malicious users deleting operational logs to hide suspicious activities or disrupt monitoring capabilities.
If Mitigated
Limited to log deletion only, no data theft or system compromise if proper access controls are implemented.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple via crafted AJAX requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.7.6 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Phrase TMS Integration' and click 'Update Now'. 4. Verify version is 4.7.6 or higher.
🔧 Temporary Workarounds
Disable vulnerable endpoint via .htaccess
linuxBlock access to the vulnerable AJAX endpoint at web server level
# Add to .htaccess in WordPress root directory
RewriteEngine On
RewriteCond %{QUERY_STRING} action=delete_log [NC]
RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]
Temporarily disable plugin
allDeactivate the vulnerable plugin until patched
wp plugin deactivate memsource-connector
🧯 If You Can't Patch
- Restrict user registration and review existing user accounts for suspicious activity
- Implement additional logging at the web server level to capture all delete attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Phrase TMS Integration' version ≤4.7.5Check Version:
wp plugin list --name='memsource-connector' --field=versionVerify Fix Applied:
Confirm plugin version is ≥4.7.6 in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual DELETE requests to /wp-admin/admin-ajax.php with action=delete_log
- Missing or truncated plugin log files
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=delete_log parameter from non-admin users
SIEM Query:
source="web_access_logs" AND uri_path="/wp-admin/admin-ajax.php" AND query_string="*action=delete_log*" AND user_agent!="*wp-admin*"