Unauthorized Data Modification in Simple User Capabilities for WordPress

CVE-2025-12157

What is CVE-2025-12157?

The Simple User Capabilities plugin for WordPress is susceptible to unauthorized modifications due to an inadequate capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint. This flaw allows unauthenticated attackers to manipulate user capabilities, potentially granting them elevated privileges or altering permissions. As a result, the integrity of user roles within WordPress sites employing this plugin is at risk, emphasizing the need for timely patching and monitoring.

References