User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery zu Privilege Escalation via Arbitrary Administrator Account Creation

The primary impact of CVE-2025-12879 is the potential for unauthorized privilege escalation. An attacker can craft a malicious request, disguised as a legitimate action, and trick a site administrator into clicking a link or visiting a compromised page. This forged request, if successful, will create a new user account with administrator privileges, granting the attacker full control over the WordPress site. This could lead to data breaches, website defacement, malware injection, and other malicious activities. The ease of exploitation, combined with the potential for significant impact, makes this a serious security concern.

WordPress sites using the User Generator and Importer plugin in versions 1.0.0 through 1.2.2 are at risk. Shared hosting environments that utilize this plugin are particularly vulnerable, as they may not have the ability to quickly update plugins or implement custom security measures. Sites with a large number of administrators are also at increased risk, as the likelihood of an administrator clicking on a malicious link increases.

• wordpress: Use wp-cli to check the plugin version:

wp plugin list --status=active | grep 'User Generator and Importer'

• wordpress: Search plugin files for the vulnerable function: grep -r "Import Using CSV File" /path/to/wordpress/wp-content/plugins/user-generator-and-importer/ • generic web: Monitor access logs for requests to the import endpoint with unusual parameters or originating from unexpected IP addresses. • generic web: Check response headers for the presence of a strong Content Security Policy (CSP) header.

1. 2025-12-05Disclosure

   disclosure

1. Reserviert2025-11-07
2. Veröffentlicht2025-12-05
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-12879 is to upgrade the User Generator and Importer plugin to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. These may include restricting access to the import functionality, implementing stricter input validation on user creation forms, or using a WordPress security plugin that offers CSRF protection. Monitor WordPress access logs for suspicious activity, particularly requests related to user creation. After upgrading, verify the fix by attempting to create a new user with administrator privileges through a crafted URL – it should be rejected.