CVE-2025-12882: 
WordPress vulnerability analysis and mitigation

CVE-2025-12882 is a privilege escalation vulnerability in the Clasifico Listing plugin for WordPress, affecting versions up to and including 2.0. The flaw allows unauthenticated attackers to register a new WordPress account and assign themselves the administrator role by supplying the listing_user_role parameter during registration. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-269 (Improper Privilege Management): the plugin fails to restrict or validate the listing_user_role parameter submitted during user registration, allowing any registrant to specify an arbitrary WordPress role — including administrator — without any server-side authorization check. The attack vector is network-based, requires no authentication, no user interaction, and low complexity, making it trivially exploitable by any remote attacker who can access the WordPress registration endpoint. No public proof-of-concept code has been confirmed at this time (Red Hat CVE, Infinitsec Advisory).

Successful exploitation grants an attacker full WordPress administrator privileges, enabling complete site compromise. This includes access to all site content and user data (confidentiality impact), the ability to modify content, install malicious plugins, or create backdoors (integrity impact), and the potential to disrupt site availability. Lateral movement within the hosting environment is possible if the attacker leverages admin access to install webshells or exploit server-side functionality (Red Hat CVE, Wordfence).

There is no confirmed public proof-of-concept exploit or evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.055% (0.000550), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat CVE, Qualys).

1. Reconnaissance: Identify WordPress sites running the Clasifico Listing plugin (version ≤ 2.0) by searching for plugin-specific indicators (e.g., /wp-content/plugins/clasifico-listing/ in page source) using tools like Shodan, Censys, or Google dorks.
2. Locate registration endpoint: Navigate to the WordPress user registration page, typically at /wp-login.php?action=register or a custom registration form provided by the plugin.
3. Craft malicious registration request: Submit a registration form (or HTTP POST request) that includes the standard fields (username, email, password) along with the additional parameter listing_user_role=administrator.
4. Confirm privilege escalation: Log in with the newly created account and verify that the account has been assigned the administrator role via the WordPress dashboard or by accessing /wp-admin/.
5. Post-exploitation: With administrator access, install malicious plugins, create additional backdoor accounts, exfiltrate user data, or modify site content to maintain persistent access (Infinitsec Advisory, Red Hat CVE).

• Logs: WordPress authentication logs (wp-login.php) showing new account registrations followed immediately by administrator-level actions; access logs with POST requests to the registration endpoint containing the listing_user_role parameter.
• WordPress Database: Unexpected entries in wp_users and wp_usermeta tables where wp_capabilities is set to administrator for recently created accounts with no legitimate business justification.
• File System: Newly installed plugins or themes not authorized by site administrators; presence of webshell files (e.g., .php files with eval, base64_decode, or system calls) in wp-content/uploads/ or plugin directories.
• Network: Outbound connections from the web server to unknown external IPs following new user registration events; unusual admin-panel activity (e.g., plugin installs, user creation) from unfamiliar IP addresses.

No official patch for the Clasifico Listing plugin has been confirmed as of the time of reporting. The recommended immediate action is to deactivate and remove the Clasifico Listing plugin (version ≤ 2.0) from all affected WordPress installations. Site administrators should audit all WordPress user accounts for unauthorized administrator accounts created recently and remove any suspicious accounts. Access logs should be reviewed for registration attempts that include the listing_user_role parameter. Organizations should contact the plugin developer for a patched version or migrate to an alternative listing plugin that properly validates user role assignment during registration (Red Hat CVE, Wordfence).

Wordfence included CVE-2025-12882 in its weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as a critical privilege escalation issue (Wordfence). The vulnerability received brief coverage on social media platforms including Mastodon and was noted in cybersecurity digest outlets. Qualys added detection for this CVE in its March 2026 application security detections update (Qualys). Overall community reaction has been moderate, consistent with the severity of the issue and the relatively niche plugin affected.