CVE-2025-12095 is a CSRF vulnerability in the Simple Registration for WooCommerce plugin for WordPress, present in all versions up to 1.5.8. The vulnerability arises from missing nonce validation in the includes/display-role-admin.php file's role requests admin page handler. This allows an attacker to craft a forged request that, if an administrator executes (e.g., by clicking a link), can approve pending role requests and escalate user privileges without authentication. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized privilege escalation by approving pending role requests, compromising site confidentiality, integrity, and availability. An attacker can gain elevated permissions without authentication by exploiting the CSRF vulnerability through social engineering of an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the web server or application firewall level. Monitor vendor channels for updates and apply patches promptly once released.