CVE-2025-12879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12879", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-07T15:59:45.326Z", "datePublished": "2025-12-05T09:27:02.498Z", "dateUpdated": "2026-04-08T17:03:56.975Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:56.975Z"}, "affected": [{"vendor": "vinoth06", "product": "User Generator and Importer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the \"Import Using CSV File\" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link."}], "title": "User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82699a17-ea45-4493-98c4-07f62ca0b1f9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/user-importer-and-generator/tags/1.2.2/user-generator.php#L145"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "timeline": [{"time": "2025-12-04T20:38:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T12:49:24.761682Z", "id": "CVE-2025-12879", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T12:49:35.519Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-05T12:49:24.761682Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T12:49:30.808Z"}}], "cna": {"title": "User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation", "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "vinoth06", "product": "User Generator and Importer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T20:38:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82699a17-ea45-4493-98c4-07f62ca0b1f9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/user-importer-and-generator/tags/1.2.2/user-generator.php#L145"}], "descriptions": [{"lang": "en", "value": "The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the \"Import Using CSV File\" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:56.975Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12879", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:56.975Z", "dateReserved": "2025-11-07T15:59:45.326Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T09:27:02.498Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "User Generator and Importer", "vendor": "vinoth06", "versions": [{"lessThanOrEqual": "1.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the \"Import Using CSV File\" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin User Generator and Importer para WordPress es vulnerable a Cross-Site Request Forgery en versiones hasta e incluyendo 1.2.2. Esto se debe a la falta de validaci\u00f3n de nonce en la funci\u00f3n 'Import Using CSV File'. Esto hace posible que atacantes no autenticados eleven los privilegios de usuario creando cuentas arbitrarias con privilegios de administrador a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-12879", "lastModified": "2026-09-25T23:10:00.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12879", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T12:49:24.761682Z", "version": "2.0.3"}}]}, "published": "2025-12-05T10:15:46.597", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/user-importer-and-generator/tags/1.2.2/user-generator.php#L145"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82699a17-ea45-4493-98c4-07f62ca0b1f9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:20:23.809183+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch that fixes the CSRF vulnerability.", "If a patch is not immediately available, disable the \"Import Using CSV File\" feature or remove the plugin entirely, ensuring that no privileged account creation functionality remains exposed.", "Implement a Web Application Firewall or similar rule set to detect and block suspicious CSRF requests targeting the import endpoint, and monitor for abnormal account creation events."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Vendors and Products: vinoth06\u2014WordPress User Generator and Importer plugin. Affected versions are all releases up to and including 1.2.2. Sites that have installed any of these versions are directly impacted, regardless of active users or roles. Back\u2011ports or custom forks that still include the vulnerable import routine are similarly at risk.", "description_and_impact": "The User Generator and Importer plugin for WordPress is vulnerable to a Cross\u2011Site Request Forgery flaw that allows an unauthenticated attacker to create a new user account with administrator privileges. The vulnerability stems from missing nonce validation in the \"Import Using CSV File\" function. If an attacker can entice a legitimate administrator to visit a crafted URL, that administrator will inadvertently create an account with full control, compromising confidentiality, integrity, and availability of the site. The weakness is classified as CWE\u2011352.", "risk_and_exploitability": "The CVSS v3.1 score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploit in the wild. The vulnerability is not currently listed in CISA\u2019s KEV catalog, further indicating limited active exploitation. Attackers would need to obtain a link that forces a logged\u2011in administrator to perform the import action; thus, while the attack vector involves a typical CSRF workflow, it requires social engineering of a site administrator. Existing vulnerable installations without mitigation could therefore be rapidly compromised if an active attacker targets them."}}}}, "created": "2025-12-05T20:56:19.888734+00:00", "updated": "2026-04-22T00:30:04.043844+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}