CVE-2025-12061: Unknown Tax Service Electronic Hdm

High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days.

The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements

Affected products

• Unknown Tax Service Electronic Hdm: before 1.2.1 (fixed in 1.2.1)

Published 2025-11-26. Last modified 2026-06-17.