CVE-2025-12879: Privilege Escalation in WordPress User Generator

The primary impact of CVE-2025-12879 is the potential for unauthorized privilege escalation. An attacker can craft a malicious link or form that, when clicked by a site administrator, will automatically create a new user account with administrator privileges. This effectively grants the attacker complete control over the WordPress site, allowing them to modify content, install malicious plugins, steal sensitive data, or even completely compromise the system. The attack requires the administrator to interact with the malicious request, typically by clicking a link or submitting a form. Successful exploitation could lead to a complete takeover of the WordPress installation, similar to scenarios where attackers gain admin access to deface websites or deploy malware.

1. Reserved2025-11-07
2. Published2025-12-05
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-12879 is to upgrade the User Generator and Importer plugin to a version that addresses the vulnerability. Unfortunately, a fixed version is not specified in the provided data. As a temporary workaround, implement strict Content Security Policy (CSP) headers to restrict the origin of scripts that can be executed on the site. Additionally, carefully review any CSV import requests and consider implementing a manual approval process for new user accounts. Monitor WordPress logs for suspicious activity, particularly related to user creation and privilege changes. Consider using a WordPress security plugin that provides CSRF protection.