CVE-2025-12901: Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12901?
CVE-2025-12901 is a medium severity vulnerability due to its ability to allow unauthenticated attackers to exploit the flaw.
How do I fix CVE-2025-12901?
To fix CVE-2025-12901, update Asgaros Forum to version 3.2.2 or later where the nonce validation issue is addressed.
What type of vulnerability is CVE-2025-12901?
CVE-2025-12901 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Which versions of Asgaros Forum are affected by CVE-2025-12901?
CVE-2025-12901 affects all versions of Asgaros Forum up to and including 3.2.1.
What are the implications of exploiting CVE-2025-12901?
Exploiting CVE-2025-12901 allows attackers to modify subscription levels without authentication, potentially affecting user permissions.