Vulnerability · Published Nov 26, 2025 · Assigned by WPScan

CVE-2025-12061Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution

High 8.6

In plain English

A high-severity missing authorization in TAX SERVICE Electronic HDM from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.2%top 91.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements

Affected products (as reported)

Vendor	Product	Versions
Unknown	TAX SERVICE Electronic HDM	0 – before 1.2.1

Weakness: CWE-862, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/1015dd69-faa5-4008-8884-f497ff980ed3/ exploit, vdb-entry, technical-description