Introduction
One click can be enough to hand an attacker full administrative control of a WooCommerce store. CVE-2025-12095 is a critical flaw in the Simple Registration for WooCommerce plugin that lets an unauthenticated attacker escalate privileges, provided they can get an administrator to interact with a crafted link. The plugin has over 5000 active installations in the WordPress e-commerce ecosystem, so the flaw matters for the online businesses that rely on WooCommerce for customer registration and management.
About the Plugin: Simple Registration for WooCommerce is a popular WordPress plugin from Astoundify. It simplifies user registration for WooCommerce-powered stores, with customizable registration forms and role management. Thousands of small to medium-sized e-commerce sites around the world use it. Role management is central to what the plugin does, which is why a privilege escalation flaw in it does so much damage.
Technical Information
CVE-2025-12095 is a Cross-Site Request Forgery (CSRF) vulnerability in all versions of the Simple Registration for WooCommerce plugin up to and including 1.5.8. The handler for the role requests admin page, in includes/display-role-admin.php, does not validate a nonce. Nonces are WordPress's standard defense against CSRF. A nonce confirms that an authenticated user intended to perform a sensitive action.
Vulnerability Details: The vulnerable code path processes role approval requests without verifying a WordPress nonce. An attacker can therefore craft a malicious request that approves a pending role request and escalates privileges when an authenticated administrator executes it, for example by clicking a malicious link.
The attacker does not need to be authenticated. The only prerequisite is that the administrator is logged in and is tricked into performing the action.
Relevant Code Location:
The missing nonce validation is in includes/display-role-admin.php (see reference).
Attack Flow:
- The attacker creates a user account with a pending role request.
- The attacker crafts a CSRF payload that submits an approval request for that account.
- While the administrator is logged in, the attacker lures them to a malicious page or link.
- The forged request runs in the administrator's context, and the attacker's account is approved with elevated privileges.
Patch Information
The developers of the WooCommerce Simple Registration plugin fixed the CSRF vulnerability by adding nonce verification to the role request approval process. A request to approve a user's role change now has to prove that it is legitimate and that it came from an authorized source.
The updated code adds a nonce field to the approval form:
<input type="hidden" name="_wpnonce" value="<?php echo wp_create_nonce('approve_role_request'); ?>">
When it processes an approval request, the plugin now verifies the nonce:
if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'approve_role_request')) { wp_die(__('Security check failed', 'woocommerce-simple-registration')); }
This check blocks unauthorized role approvals through CSRF, so only legitimate requests can modify user roles.
Patch source: https://plugins.trac.wordpress.org/changeset/3383124
Affected Systems and Versions
- Product: Simple Registration for WooCommerce (WordPress plugin)
- Affected versions: All versions up to and including 1.5.8
- Secure version: 1.5.9 and later
- Any WordPress site with the plugin installed and activated in the affected version range is vulnerable, regardless of other configuration.
Vendor Security History
Astoundify, the developer of Simple Registration for WooCommerce, has fixed several vulnerabilities in recent versions of the plugin. Version 1.5.7 (April 2024) fixed a privilege escalation issue, and version 1.5.8 (January 2025) included a security update for another, unspecified vulnerability. Privilege escalation and CSRF issues keep recurring in recent releases, which suggests the vendor's security review and testing processes need work. Patches appear to arrive promptly once a vulnerability is reported, but the changelogs often give few details, which may delay users learning that an update matters.
