CVE-2025-12095: Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval
The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8. This is due to missing nonce validation on the role requests admin page handler in the includes/display-role-admin.php file. This makes it possible for unauthenticated attackers to approve pending role requests and escalate user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12095?
CVE-2025-12095 is a medium severity vulnerability due to Cross-Site Request Forgery in the Simple Registration for WooCommerce plugin.
How do I fix CVE-2025-12095?
To fix CVE-2025-12095, update the Simple Registration for WooCommerce plugin to version 1.5.9 or later.
What are the impacts of CVE-2025-12095?
CVE-2025-12095 allows attackers to perform unauthorized actions on behalf of users due to missing nonce validation.
Which versions are affected by CVE-2025-12095?
CVE-2025-12095 affects all versions of the Simple Registration for WooCommerce plugin up to and including version 1.5.8.
Is CVE-2025-12095 specific to certain WordPress setups?
CVE-2025-12095 is not specific to certain setups; it affects any WordPress installation using the vulnerable plugin.