CVE-2025-12770: New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling
The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key validation using loose equality comparison. This makes it possible for unauthenticated attackers to retrieve personally identifiable information (PII), including usernames and email addresses of users with various approval statuses via the Zapier REST API endpoints, by exploiting PHP type juggling with the apikey parameter set to "0" on sites where the Zapier API key has not been configured.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12770?
CVE-2025-12770 is classified as a medium severity vulnerability due to the potential for unauthorized data disclosure.
How do I fix CVE-2025-12770?
To fix CVE-2025-12770, upgrade the New User Approve plugin to version 3.1.0 or later.
Who is affected by CVE-2025-12770?
CVE-2025-12770 affects all users of the New User Approve plugin for WordPress up to and including version 3.0.9.
What type of vulnerability is CVE-2025-12770?
CVE-2025-12770 is a data disclosure vulnerability caused by insufficient API key validation.
Can unauthenticated users exploit CVE-2025-12770?
Yes, unauthenticated users can exploit CVE-2025-12770 to retrieve personally identifiable information.