CVE-2025-12170: Bandido Checkbox

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to, and including, 2.8.10. This makes it possible for unauthenticated attackers to clear log files.

Affected products

• Bandido Checkbox: up to and including 2.8.10

Published 2025-11-21. Last modified 2026-10-07.