What is the CVSS score of CVE-2025-12095?

CVE-2025-12095 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WooCommerce Simple Registration are affected by CVE-2025-12095?

A high-severity privilege-escalation flaw in the WooCommerce Simple Registration plugin (versions up to and including 1.5.8) can allow an attacker to turn a pending role request into administrator…

How to fix or mitigate CVE-2025-12095?

Within 24 hours, inventory every WordPress installation running WooCommerce Simple Registration at version 1.5.8 or earlier and, where the plugin's role-approval workflow is not essential to operations, deactivate and remove it; where it must remain, clear all pending role requests and restrict wp-admin access to named administrators protected by multi-factor authentication. Within 7 days, if no fixed version above 1.5.8 is available, deploy WAF or reverse-proxy rules that reject state-changing requests to the plugin's role-approval endpoint when a valid WordPress nonce is absent or when the request originates off-site, shorten administrator session lifetimes, and enable alerting on unexpected role changes or newly created administrator accounts. Within 30 days, re-check the vendor channel for a fixed release above 1.5.8, schedule replacement or removal of the plugin if none is published, restrict the ability to submit role requests to trusted users only, and fold unpatched-plugin review and least-privilege role approval into standard WordPress hardening.

WooCommerce Simple Registration CVE-2025-12095

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-25 security@wordfence.com

PHP WordPress CSRF Woocommerce Wordpress Plugin

8.8

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

CSRF reachable over the network with no attacker privileges (PR:N) but requiring admin interaction (UI:R); C/I/A:H assumes the approved role request yields a high-privilege account.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 11:58 vuln.today

CVE Published

Oct 25, 2025 - 06:15 cve.org

HIGH 8.8

DescriptionCVE.org

The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8. This is due to missing nonce validation on the role requests admin page handler in the includes/display-role-admin.php file. This makes it possible for unauthenticated attackers to approve pending role requests and escalate user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in the WooCommerce Simple Registration plugin for WordPress (versions up to and including 1.5.8) allows unauthenticated attackers to approve pending role requests and escalate user privileges by tricking an authenticated site administrator into clicking a crafted link. The flaw is missing nonce validation in the role-approval handler, and exploitation requires an existing pending role request plus administrator interaction, making it conditional rather than opportunistic. No public exploit has been identified, and the EPSS score is low (0.20%, 9th percentile).

Technical ContextAI

The vulnerability is a classic CSRF (CWE-352) in the WordPress plugin 'Simple Registration for WooCommerce'. WordPress uses nonces (security tokens tied to a user session and action) to protect state-changing requests from forgery. The plugin's role-request admin handler in includes/display-role-admin.php fails to validate a nonce when processing role approvals. Consequently, an attacker can craft a link that, when visited by a logged-in administrator, submits a forged request to approve a pending role request. The impact is privilege escalation because the approved role could be elevated (e.g., administrator), though the actual ceiling depends on the role specified in the pending request. No CPE data was provided; the affected component is the plugin up to version 1.5.8.

Affected ProductsAI

The WooCommerce Simple Registration plugin for WordPress, versions up to and including 1.5.8, is affected. The vulnerability resides in the includes/display-role-admin.php file. No CPE entries were provided in the input data. Refer to the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/9c32fcaf-afc3-4493-8cd8-6f49bbe40c7b?source=cve) and the WordPress plugin trac changeset (https://plugins.trac.wordpress.org/changeset/3383124) for more details.

RemediationAI

Upgrade to a version of the plugin that includes the upstream fix (changeset 3383124, available at https://plugins.trac.wordpress.org/changeset/3383124); a patched release version number is not yet confirmed. Until a patched version is available, disable the plugin or remove the role-request feature if it is not essential. As a compensating control, restrict administrative access to trusted IPs and educate administrators about the risks of clicking untrusted links while logged in. Note that disabling the plugin may break site registration functionality. Monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/9c32fcaf-afc3-4493-8cd8-6f49bbe40c7b?source=cve) for updates.