CVE-2025-12752
📋 TL;DR
The Subscriptions & Memberships for PayPal WordPress plugin fails to properly verify PayPal IPN requests, allowing unauthenticated attackers to create fake payment records. This affects all WordPress sites using this plugin up to version 1.1.7. Attackers can manipulate payment statuses without actual transactions occurring.
💻 Affected Systems
- Subscriptions & Memberships for PayPal WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers create numerous fake premium subscriptions, granting unauthorized access to paid content, manipulating revenue reports, and potentially causing financial discrepancies.
Likely Case
Attackers create fake payment entries to access premium content without paying, disrupting subscription management and causing minor financial reporting issues.
If Mitigated
With proper IPN verification and monitoring, impact is limited to attempted attacks that are logged and blocked.
🎯 Exploit Status
Exploitation requires sending crafted IPN requests to the vulnerable endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.8
Vendor Advisory: https://plugins.trac.wordpress.org/browser/subscriptions-memberships-for-paypal/trunk/includes/public_ipn.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Subscriptions & Memberships for PayPal'. 4. Click 'Update Now' if available. 5. If not, download version 1.1.8+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate subscriptions-memberships-for-paypal
Restrict IPN Endpoint Access
linuxBlock external access to the IPN endpoint via web server configuration.
# In Apache .htaccess: RewriteRule ^wp-content/plugins/subscriptions-memberships-for-paypal/includes/public_ipn\.php$ - [F]
# In Nginx: location ~ ^/wp-content/plugins/subscriptions-memberships-for-paypal/includes/public_ipn\.php$ { deny all; }
🧯 If You Can't Patch
- Disable the plugin immediately to prevent exploitation.
- Implement network-level filtering to block suspicious IPN requests to the plugin endpoint.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 1.1.7 or lower, you are vulnerable.Check Version:
wp plugin get subscriptions-memberships-for-paypal --field=versionVerify Fix Applied:
After updating, verify plugin version shows 1.1.8 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /wp-content/plugins/subscriptions-memberships-for-paypal/includes/public_ipn.php from unusual IPs
- Payment entries created without corresponding PayPal transaction IDs
Network Indicators:
- Unusual traffic to the IPN endpoint from non-PayPal IP addresses
- HTTP POST requests to public_ipn.php with manipulated parameters
SIEM Query:
source="web_logs" AND uri="/wp-content/plugins/subscriptions-memberships-for-paypal/includes/public_ipn.php" AND method="POST" AND NOT src_ip IN (paypal_ip_range)🔗 References
- https://plugins.trac.wordpress.org/browser/subscriptions-memberships-for-paypal/trunk/includes/public_ipn.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397608%40subscriptions-memberships-for-paypal&new=3397608%40subscriptions-memberships-for-paypal&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d?source=cve
