CVE-2025-12350

Name of the Vulnerable Software and Affected Versions DominoKit versions prior to 1.1.1

Description The DominoKit plugin for WordPress allows unauthorized access because it fails to perform a capability check on the wp ajax nopriv dominokit option admin action AJAX endpoint. This flaw enables unauthenticated attackers to modify plugin settings.

Recommendations Update the plugin to a version later than 1.1.0. Restrict access to the wp ajax nopriv dominokit option admin action endpoint as a temporary mitigation.