PT-2025-43710 · Unknown+1 · Woocommerce+1

Published 2025-10-25 · Updated 2025-10-30 · CVE-2025-12095

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Registration for WooCommerce versions prior to 1.5.9

Description The Simple Registration for WooCommerce plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) issue. This occurs because of a lack of nonce validation on the role requests admin page handler located in the includes/display-role-admin.php file. An unauthenticated attacker could potentially approve pending role requests and elevate user privileges by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update Simple Registration for WooCommerce to version 1.5.9 or later.

Fix

LPE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-12095

Affected Products

Simple Registration For Woocommerce

Woocommerce

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-12095 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9c32fcaf-afc3-4493-8cd8-6f49bbe40c7b?source=cve · Note
• https://twitter.com/CveFindCom/status/1981958938372309368 · Twitter Post
• https://twitter.com/CveTodo/status/1983085672673010173 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woocommerce-simple-registration/tags/1.5.8/includes/display-role-admin.php#L132 · Note
• https://t.me/CVEtracker/35731 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3383124 · Note
• https://twitter.com/CVEnew/status/1981959747323462046 · Twitter Post
• https://twitter.com/cracbot/status/1983851415463457046 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981983680563187935 · Twitter Post
• https://twitter.com/RedPacketSec/status/1982020444401086799 · Twitter Post
• https://t.me/cveNotify/140339 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1981973752347775340 · Twitter Post