by Kastro
Paper/Archive/CVE-2025-12158

CVE-2025-12158

tanvirahmed1984 Simple User Capabilities — Simple User Capabilities <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.3.393 × 207.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.

Affected

ProductAffectedFixed inSource
Simple User Capabilities≤ 1.0–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/dd75b8ec-1961-4a7a-92e6-1517e638974b?source=cverefplugins.svn.wordpress.org/simple-user-capabilities/tags/1.0/user_access.phprefwordpress.org/plugins/simple-user-capabilities