CVE-2025-12879: 
WordPress vulnerability analysis and mitigation

CVE-2025-12879 is a Cross-Site Request Forgery (CSRF) vulnerability in the User Generator and Importer plugin for WordPress, affecting versions up to and including 1.2.2. The flaw allows unauthenticated attackers to create arbitrary administrator accounts by tricking a logged-in site administrator into clicking a malicious link. It was published on December 5, 2025, with the assigner credited as Wordfence. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The root cause is missing nonce validation in the "Import Using CSV File" function of the plugin (CWE-352: Cross-Site Request Forgery). Because the function does not verify a WordPress nonce before processing CSV import requests, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, causes the server to import a CSV file containing a new user with administrator-level privileges. The vulnerable code path is visible in the plugin source at user-generator.php line 145 (Wordfence, Plugin Source). Exploitation requires user interaction — specifically, an administrator must be socially engineered into clicking a crafted link or visiting a malicious page while authenticated.

Successful exploitation allows an unauthenticated attacker to create arbitrary WordPress user accounts with full administrator privileges, resulting in complete site compromise. This grants the attacker the ability to install malicious plugins or themes, exfiltrate sensitive data, modify site content, and potentially pivot to the underlying server infrastructure. Confidentiality, integrity, and availability are all rated as High impact (Wordfence, ENISA EUVD).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation is constrained by the requirement for administrator interaction, reducing the likelihood of opportunistic mass exploitation.

1. Reconnaissance: Identify WordPress sites running the User Generator and Importer plugin version ≤1.2.2 using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious CSV payload: Prepare a CSV file containing a new user entry with administrator role (e.g., username,email,password,role → eviluser,attacker@evil.com,P@ssw0rd,administrator).
3. Build forged request: Construct an HTML page or link that auto-submits a POST request to the target WordPress site's admin endpoint for the "Import Using CSV File" function, embedding the malicious CSV data. Since no nonce is validated, the request will be accepted if sent from an authenticated session.
4. Social engineering: Deliver the malicious link or page to a site administrator via phishing email, comment, or other channel, inducing them to click it while logged into the WordPress admin panel.
5. Account takeover: Once the forged request is processed, the attacker's administrator account is created. The attacker then logs in with the newly created credentials to achieve full site control (Wordfence, Plugin Source).

• Logs: WordPress admin logs or server access logs showing unexpected POST requests to the CSV import endpoint (e.g., wp-admin/admin.php?page=user-importer) from unusual referrers or at unusual times.
• User Accounts: Newly created WordPress administrator accounts not provisioned by legitimate administrators, particularly accounts with generic or suspicious usernames/emails.
• File System: Unexpected plugin or theme installations, or modified wp-config.php or core files, following the appearance of unauthorized admin accounts.
• Network: Outbound connections from the WordPress server to unknown external hosts, potentially indicating post-compromise activity such as backdoor installation or data exfiltration.

Administrators should update the User Generator and Importer plugin to a version newer than 1.2.2 that addresses the missing nonce validation (Wordfence, ENISA EUVD). If an updated version is not yet available, consider disabling the plugin until a patch is released. Additional mitigations include regularly auditing WordPress user accounts and roles for unauthorized entries, enforcing strong authentication (e.g., MFA) for administrator accounts, and training administrators to be cautious of unsolicited links.

The vulnerability was reported by Wordfence and received standard coverage from automated vulnerability tracking services including VulnDB, Vulners, and CIRCL. RedPacketSecurity published a brief alert on the CVE. No significant researcher commentary, vendor statements beyond the Wordfence advisory, or notable media coverage has been identified for this vulnerability.