CVE-2025-12901: 
WordPress vulnerability analysis and mitigation

The Asgaros Forum plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2025-12901) affecting all versions up to and including 3.2.1. The vulnerability was discovered and disclosed on November 11, 2025, and was assigned a CVSS score of 4.3 (Medium) (Wordfence).

The vulnerability stems from missing nonce validation in the setsubscriptionlevel() function within the forum-notifications.php file. This security flaw allows for CSRF attacks against the subscription settings functionality. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

When exploited, this vulnerability allows unauthenticated attackers to modify the subscription settings of authenticated users through forged requests. The attack requires user interaction, such as clicking on a malicious link, and can lead to unauthorized changes to forum subscription preferences (NVD).

The vulnerability has been patched by implementing proper nonce validation in the setsubscriptionlevel() function. The fix includes adding wpnoncefield() for form validation and verifying the nonce before processing subscription level changes (Github Commit).