Cross-Site Request Forgery Vulnerability in WPFront User Role Editor Plugin for WordPress

CVE-2025-3064

What is CVE-2025-3064?

The WPFront User Role Editor plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability. This flaw arises from inadequate nonce validation in the whitelist_options() function, allowing unauthenticated attackers to manipulate the default role option. By tricking a site administrator into executing a forged request, attackers can escalate privileges, particularly in multisite setups. This vulnerability underscores the importance of robust nonce verification to protect user roles and ensure plugin security.

References