Cross-Site Request Forgery Vulnerability in Simple Registration for WooCommerce by WordPress

CVE-2025-12095

What is CVE-2025-12095?

The Simple Registration for WooCommerce plugin for WordPress is susceptible to Cross-Site Request Forgery due to a lack of nonce validation on the role requests admin page handler. This flaw enables unauthenticated attackers to leverage this vulnerability to approve pending role requests without authorization, allowing them to escalate user privileges by tricking an admin into taking action such as clicking on a malicious link. This presents a significant risk to site security, necessitating prompt action from users to mitigate potential exploits.

References