CVE-2025-12061 — Vulnerability intelligence

— TAX SERVICE Electronic HDM

Published: 2025-11-26T06:00:08.258Z

CVSS

8.6

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements

Sources

• CVE-2025-12061
• Original advisory
• CVE-2025-12061