Data Disclosure Vulnerability in New User Approve Plugin for WordPress

CVE-2025-12770

What is CVE-2025-12770?

The New User Approve plugin for WordPress presents a serious risk of unauthorized data disclosure. All versions up to and including 3.0.9 contain a flaw in the API key validation system which improperly utilizes loose equality comparison. This vulnerability enables unauthenticated attackers to exploit the Zapier REST API endpoints, allowing them to retrieve personally identifiable information (PII) such as usernames and email addresses of users with various approval statuses. The issue arises particularly when the api_key parameter is set to '0', and the Zapier API key is not correctly configured, posing a significant threat to user data security.

References